Reversible watermarking

ABSTRACT

A reversible watermarking method embeds auxiliary data into a data set, such as an image, audio, video or other data, in a manner that enables full recovery of the original, un-modified data set. This method may be used to determine whether the data set has been tampered. To improve embedding capacity without the need for compression of the auxiliary data, the method uses an expansion technique. One particular approach exploits the correlation or redundancy within the data set to convert the data to a set of small, expandable values, such as difference values. These small values are then expanded by inserting auxiliary data as one or more additional bits, increasing the number of bits without causing an underflow or overflow. This approach also uses a property of the data set that is invariant to the embedding operation to identify embedding locations, obviating the need for separate data to identify where data is embedded in a data set.

RELATED APPLICATIONS

This application claims the benefit of provisional application60/404,181, filed Aug. 16, 2002, 60/340,651, filed Dec. 13, 2001, and60/430,511, filed Dec. 2, 2002, entitled Reversible Watermarking by JunTian and Steve Decker.

This application is also related to application Ser. No. 10/035,830filed Oct. 18, 2001 (Now U.S. Pat. No. 7,389,420), which claims thebenefit of provisional applications:

-   -   a) 60/247,389, filed Nov. 8, 2000;    -   b) 60/260,907, filed Jan. 10, 2001; and    -   c) 60/284,594 filed Apr. 17, 2001.

The entire content of the above listed applications is herebyincorporated herein by reference.

FIELD OF THE INVENTION

The invention relates to steganography, auxiliary data embedding in datasets, and digital watermarks.

BACKGROUND AND SUMMARY

The technology for digital watermarking media content, such as images,video and audio is well known. A variety of different types of digitalwatermarks have been developed. Some types of digital watermarks can beread from watermarked data despite changes in the data. For example,some types of image watermarks can survive when the watermarked image isrotated, spatially scaled, lossily compressed, and/or printed. Somevideo and audio watermarks survive when the watermarked content islossily compressed, converted to analog form, and re-sampled intodigital form.

Some digital watermarks are designed to be fragile so that if thewatermarked data is changed the watermark is rendered unreadable or isdegraded in a predictable fashion. Such watermarks can be used todetermine if a watermarked document has been changed based on detectionof the digital watermark. If certain data is watermarked with a fragilewatermark, and the data is later changed the watermark is degraded orrendered unreadable. Thus, the absence or degradation of a watermarkwill indicate that the data has been changed.

Some digital watermarks are designed to be reversible. A watermark isreversible if a data set can be watermarked, thereby changing the datasomewhat, and at a later time the watermark can be removed in order toreturn to the original un-watermarked data set.

The technique used to watermark an image (or data set) determines suchfactors as: the extent to which a watermark can survive changes in animage, the amount of change in an image needed to destroy a fragilewatermark, and how accurately an image can be recreated after areversible watermark is removed.

One challenge that occurs with some reversible watermarks is that theycan cause overflow or underflow conditions. For example, consider adigital image or audio signal that is represented by values from 0 to255. If during the digital watermarking operation, a digital sample withthe value of 254 is increased by 2, there will be an overflow condition.Likewise, if a sample with a value of 1 is decreased by 2, an underflowcondition will occur. When an overflow or underflow occurs during awatermarking operation, it poses limitations on the ability to recoverthe original, un-watermarked signal.

The invention provides a number of methods and related software andsystems for embedding auxiliary data in data sets, and for decoding thisauxiliary data from the data sets. One aspect of the invention is amethod of reversibly embedding auxiliary data in a data set. This methodtransforms the data set from an original domain into transformed datavalues with an invertible transform. It expands selected data values toembed auxiliary data. The method then inverts the transformed datavalues, including the data values selected for expansion, to return thetransformed data values to the original domain.

Another aspect of the invention is a compatible decoder for extractingthe embedded data and restoring the values of the data set to the samevalues as before embedding of the auxiliary data. This decodertransforms the data set from an original domain into transformed datavalues with an invertible transform. It extracts auxiliary data fromdata values previously selected for embedding of auxiliary data byexpansion, and restores the selected data values to the same values asbefore the embedding of the auxiliary data. It then inverts thetransformed data values, including the data values selected forexpansion, to return the transformed data values to the original domain.

Another aspect of the invention is a method of reversibly embeddingauxiliary data in a data set. This embedding method selects embeddinglocations in the data set that have a property that is invariant tochanges due to embedding of the auxiliary data. The invariant propertyenables a decoder to identify embedding locations. The embedding methodthen reversibly embeds auxiliary data into data values at the embeddinglocations.

Another aspect of the invention is a method of decoding reversiblyembedded auxiliary data in a data set. This method identifies a subsetof locations in the data set that have a property that is invariant tochanges due to embedding of the auxiliary data. It extracts auxiliarydata from data values at the identified locations. It then restoresvalues of the data set to the same values as before the embedding of theauxiliary data into the data set.

Another aspect of the invention is a method of embedding auxiliary datain a data set. This method identifies values derived from the data setthat are expandable. It expands the identified values by inserting anauxiliary data state corresponding to auxiliary data to be embedded inthe identified values. This method has a corresponding decoding method,and can be used for reversible data embedding applications.

Further features will become apparent from the following detaileddescription and accompanying drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1A is a diagram illustrating an expansion method for auxiliary dataembedding into a data set.

FIG. 1B is a diagram illustrating an auxiliary data decoder compatiblewith the data embedding method of FIG. 1A

FIG. 1C is a diagram illustrating an embedding operation forauthentication applications.

FIG. 1D is a diagram illustrating authentication by extracting theembedded data, re-creating the original data, and using the embeddeddata to authenticate the data.

FIG. 1E is a diagram illustrating a reversible watermarking method usedto select elements for embedding based on whether the element has aproperty that is invariant to the embedding operation.

FIG. 1F is a diagram illustrating the decoding of a reversible watermarkthat takes advantage of the invariant property to identify embedded datalocations.

FIG. 2A is a diagram of an image showing a pattern of bit pairs.

FIG. 2B is a diagram illustrating changeable and unchangeable bits indifference values.

FIG. 3 is an overall block flow diagram of the watermark embeddingprocess.

FIG. 4 is a block flow diagram of the watermark reading process.

DETAILED DESCRIPTION

Various preferred embodiments of the invention will be described. Theembodiments provide a method or technique for embedding a digitalwatermark into a data set, such as an image. Embodiments illustrate areversible watermarking method that enables decoding of the digitalwatermark, and exact re-creation of the original, un-watermarked data.

While certain embodiments described below relate to digital watermarkingof image signals, the invention can be used to watermark other types ofdata such as audio data.

FIG. 1A illustrates a flow diagram of an expansion method for auxiliarydata embedding into a data set. This particular method is designed to beinvertible in cases where there are no changes to the data set (e.g.,“fragile” data embedding). Variations of the method may be designed tomake the data method more robust to certain types of changes to the dataset and partially reversible. For example, the method may be employedhierarchically to transformations of the data set into layers of valuesthat have varying robustness.

As illustrated in FIG. 1A, the embedder starts with a data set 20. Forapplications that we are targeting, this data set comprises a set ofintegers (e.g., 8 bit values ranging from 0-255). The embedder performsan integer to integer transform of the data into values for expansion(22). This transform maps sets of data elements in the data set intovalues for expansion. The embedder applies this transform across theentire data set to be embedded with auxiliary data (e.g., it is repeatedon groups of elements throughout the data set). Note that in someapplications, the data may undergo one or more pre-processing steps toplace the data into a better format for the data embedding method.

The specific type of transform may vary, and the implementer may selectthe transform for the needs of the application. One of our applicationsof the method is reversible digital watermark embedding for images. Ourcriteria include making the embedding operation perfectly reversible,maintaining (or at least controlling to a desired degree) the perceptualquality of the image signal, and embedding capacity of the digitalwatermark. In other applications, other objectives may be important,such as retaining some level of lossless compressibility of the embeddeddata, enhancing the security of the embedding process (e.g., making thenature of the transform statistically undetectable), etc.

In our specific embodiments, the embedder transforms sets of integerdata to corresponding sets of values for expansion, including fixed andvariable values. The fixed values remain unchanged in the subsequentexpansion embedding operation. The variable values are selected forexpansion to serve as carriers of the embedded data. We selected atransform that generates fixed values that enables reversibility andperceptual quality control. We also selected this transform because itgenerates small integer variable values that are likely to be moreexpandable to provide for higher information carrying capacity. Thespecific transform is a transform of sets of the data into correspondingsets of averages and difference values. Other transforms that satisfythe criteria may be selected as well.

Next, the embedder performs an invertible expansion of values in thesets of values transformed for expansion (24). This expansion isreferred to as invertible because it enables the auxiliary data decoderto extract the embedded data values for each set, and compute theoriginal data values computed for expansion in the embedder.

The sets of data include two or more data elements. The embeddertransforms these data elements into a corresponding set of values forexpansion. The embedder embeds auxiliary data by expanding selectedvalues for expansion in this set into expanded values that representauxiliary data. The auxiliary data may be binary or higher state (e.g.,two or more possible states for the embedded data value).

In the case of the transform to sets of fixed and variable values, theembedder expands the variable values into expanded values that carry thebinary or higher embedded state. The expansion operation multiplies avalue for expansion by an integer corresponding to the number of statesand adds the desired state.

Here are examples of expanding an integer, I, using a two or more stateexpansion operation:

Two States:

-   -   2I+0    -   2I+1        Three States:    -   3I+0    -   3I+1    -   3I+2        N States:    -   NI+0    -   NI+1    -   NI+2    -   .    -   .    -   NI+(N−1)

Next, the embedder performs the inverse of the transform in block 22 onthe sets of values, including expanded values (26). This inversetransform returns the embedded data set 28 back to its original domainat the input of the process.

FIG. 1B illustrates the corresponding auxiliary data decoder. First, thedecoder performs the same transform as in block 22 to place the datainto the domain where it was expanded (30). Next, the decoder extractsthe auxiliary data values by performing the inverse of the invertibleexpansion operation (32). In the case where the expansion multiplies bythe number of states and adds the desired state, the decoder extractsthe embedded data value directly by reading the state that has beenadded to the expanded value. This inverse of the expansion provides theoriginal un-expanded value as well as the embedded data value.

Having recovered the un-expanded value in the set, the decoder nowperforms the inverse transform (34) as in block 26 to get the originaldata set 36.

To help illustrate, we show examples of this method in mathematicalform. First, we illustrate an example of a transform of data elements,p₁, p₂, and p₃, into values for expansion a, d₁, and d₂.

Generally, the transformation involves two or more elements of the dataset into the values for potential expansion. In this case, we illustratea transform involving three elements of the data set:

$\begin{bmatrix}a \\d_{1} \\d_{2}\end{bmatrix} = {f\left( \begin{bmatrix}p_{1} \\p_{2} \\p_{3}\end{bmatrix} \right)}$A specific example of the function ƒ is:

$a = \left\lfloor \frac{p_{1} + p_{2} + p_{3}}{3} \right\rfloor$d₁ = p₂ − p₁ d₂ = p₃ − p₁where └ ┘, is the least integer function.

For embedding data in digital images, the data elements correspond todiscrete image samples, such as pixels in the spatial domain of theimage. In this example, one can see that the value, a, comprises anaverage of the elements, while d₁ and d₂ comprise difference values ofselected pairs of the elements. The average may be weighted differently.For images, the data samples may correspond to grayscale values, or forcolor images, the samples may correspond to luminance, chrominance, or aselected combination of samples from some other color channel or colormapping. As an example, the color components R, G, B or CMY, may beuncorrelated before embedding and then independently embedded.Alternatively, the transform A may compute the fixed value as a functionof the RGB values: (R+2G+B)/4, for example.

Though not a requirement, this transformation shows an example of a casewhere the transform produces fixed and variable values: a remains fixedin the expansion operation, while d₁ and d₂ are potentially expanded.

This example illustrates that the data elements in the set, and theirarrangement in the original data set may vary. In the case where theimplementer is seeking better embedding capacity, the data elements arepreferably selected to provide highly expandable values. In aninvertible expansion method, smaller values are preferable because theycan be expanded further before causing a non-invertible exception,namely, an underflow or overflow of the data elements, which areconstrained to a predetermined range of integers.

In the case of digital data, such as 8 bit values, the values areconstrained to a range of integers such as 0 to 255. In the case ofdigital image pixels that are transformed into fixed average values andexpandable differences, highly correlated pixel values provide thesmallest difference values, and as such, are more expandable. Thus,selecting a pattern of neighboring data elements tends to provide groupsof correlated elements, whose difference values are more expandable.

The 2^(nd) and 3^(rd) equations representing the transformation aremerely functions that give small numbers that are expandable. Thedifference between two correlated values is just one example. Antherexample is the difference between a data element and some fixed valuesuch as 0 or 255. By varying the transform function adaptivelythroughout the data set, the embedder can optimize the capacity,perceptibility, or some other combination of criteria. To inform thedecoder of the proper function selected at embedding, the embedder maybase the selection of the function based on data element features thatare invariant to the embedding operation, or it may make theidentification of the function part of the key used to decode theembedded data.

Next, to illustrate data embedding through expansion in this example,consider the following expression:

${\begin{bmatrix}p_{1}^{\prime} \\p_{2}^{\prime} \\p_{3}^{\prime}\end{bmatrix} = {f^{- 1}\left( {{E\begin{bmatrix}a \\d_{1} \\d_{2}\end{bmatrix}} + \begin{bmatrix}0 \\s_{1} \\s_{2}\end{bmatrix}} \right)}},$where ƒ¹ is the inverse function of ƒ as shown in the following example:

$p_{1} = {a - \left\lfloor \frac{d_{1} + d_{2}}{3} \right\rfloor}$p₁ = d₁ − p₁ p₂ = d₂ − p₁E is the expansion matrix as shown in the following example:

$\begin{bmatrix}p_{1}^{\prime} \\p_{2}^{\prime} \\p_{3}^{\prime}\end{bmatrix} = {f^{- 1}\left( {{\begin{bmatrix}1 & 0 & 0 \\0 & {N1} & 0 \\0 & 0 & {N2}\end{bmatrix}\begin{bmatrix}a \\d_{1} \\d_{2}\end{bmatrix}} + \begin{bmatrix}0 \\s_{1} \\s_{2}\end{bmatrix}} \right)}$

In this example, the first row of the expansion matrix illustrates thata is the fixed value, while the next two rows represent functions thatexpand values d₁ and d₂ as a function of the number of states, N, andthe desired state of the symbol to be embedded, s. The number of statesper expandable value is variable. The total number, M (3 in the exampleabove), of data elements, p, is also variable in function ƒ.

The total embedding capacity per grouping of elements, p, in thefunction ƒ can be represented as:

-   -   (M−1))Log₂N bits; and the capacity per data element, p can be        represented as:    -   ((M−1)/M) Log₂N bits

As shown in this example, the transformation of the expanded data by theinverse of ƒ, produces the embedded data set, p₁′, p₂′ and p₃′.

For reversibility, the embedder preferably uses invertible integer tointeger transforms. In our implementation, we use the floor function toensure that the functions, ƒ and E, are integer to integer andinvertible.

The methods outlined above may be repeated on the data set to embedadditional layers of auxiliary data, each possibly with a differentdecoding key used to enable decoding of the layer. Specifically, theinput of one embedding operation may produce an embedded data set thatis input to another embedding operation. This embedding may be performedrepeatedly and hierarchically to embed additional data. A hierarchicalapproach applied to expandable values in different transform domains ofvarying robustness can provide an embedding scheme that is robust andreversible in part. One example would be to apply the methodhierarchically to different spatial resolutions of an image. Forexample, the implementer may seek to embed data by expanding thedifference of average values, which are more robust to distortion.

As the implementer seeks to improve the performance of the dataembedding to optimize capacity, perceptual quality, robustness,detectability, etc., the domain of the data set and the transform of thedata set to values for expansion may be selected to optimize the desiredperformance criteria.

As the implementer seeks to make the data embedding more robust, thereare tradeoffs with embedding capacity and being able to achieve perfectreversibility. If the embedded data must survive certain types ofdistortion, the distortion may preclude reversibility of all or aportion of the data that is embedded in attributes that are altered bythe distortion. Conversely, unaltered robust attributes that carry theembedded data can remain reversible.

In general, to increase robustness, the implementer can select apre-processing operation on the data set that transforms it into adomain that is more robust to the expected forms of distortion. Forexample, if some loss of the original data were tolerated, the originaldata set may be pre-quantized with more coarse quantization beforeapplying the data embedding method. Also, while our examples focus onspatial domain pixels, the data embedding method applies to otherdomains such as wavelet, DCT, Fourier, etc.

One observation of the example transform of data to fixed averages andexpandable differences is that a lower resolution thumbnail image may becomputed using the average function. In this case, the thumbnail of thewatermarked and un-watermarked image computed by this average functionare the same.

For images, the method may be repeated on contiguous tiles of pixels,each embedded with its own reference code that enables the data to berobust to cropping.

FIGS. 1C and 1D shows compatible embedder and decoder processes thatensure there is no difference between the original data set and there-created data set. The process begins with an original data set 101.As indicated by block 102, the embedder calculates authentication data,such as a hash of the original data, error detection data, a fixedmessage, or an error correction encoded message that can be analyzed todetect the presence of errors in the embedded data. As indicated byblock 103, the embedder embeds auxiliary data in the data set 101,including the authentication data along with other auxiliary data. Theembedded data set is designated 104.

When one wants to recreate the original data set, the embedded data set104 is processed as indicated by block 105 to read the embeddedauxiliary data. Processes used to read the auxiliary data are explainedfurther below. The authentication data and various other auxiliary dataare extracted from the embedded data set 104. The extracted data is usedto re-create the original data set from the embedded data set asindicated by block 106. Finally, the reader uses the authentication datato check whether the re-created data set is unmodified (e.g., the sameas the original data set). For example, a new hash number X2 iscalculated from the re-created data set. If the hash number X2 equalsthe embedded hash X, it means that the original data set and there-created data set are identical.

Alternatively, an error detection message can be used to detect whetherthe extracted auxiliary data is error free, which is expected if theembedded data set has not been modified. Other fixed data messages inthe auxiliary data can be checked for errors by comparison with a known,expected message. Finally, an error corrected version of embedded datamay be used to regenerate a new error correction encoded message, whichis then compared with the extracted, error correction encoded message tocheck for errors.

In some applications, it is useful to be able to identify whereauxiliary data is embedded in an embedded data set using only theembedded data (e.g., without a map separate from the embedded data). Oneapproach to accomplish this is to identify and embed at least some ofthe auxiliary data in embedding locations that are identifiable beforeand after the embedding operation. In particular, certain features canbe selected that are invariant to the embedding operation and serve toidentify an embedding location. These features enable the auxiliary datadecoder to identify variable embedding locations by finding the locationof features with the invariant property.

FIG. 1E illustrates an embedding method that identifies data elements inan image that are invariant to auxiliary data embedding to enable thedecoder to locate the embedded data. A similar approach may be used forembedding auxiliary data in other data types. First, as indicated byblock 111, an optional transform is applied to an original image 110 toproduce a transformed image 112. One example of this transform 111calculates difference and average values for pairs of pixels in animage. Next as indicated by blocks 113, certain elements in thetransformed image 112 are identified. The identified elements have aproperty that remains identifiable after they are changed by auxiliarydata embedding. The identified elements are illustrated as blocks 112A.It should be understood that in a practical application, an image hasmany thousand of such elements. For convenience of illustration, only afew such elements 112A are illustrated in FIG. 1E.

An auxiliary data stream 114 is embedded in the image. The auxiliarydata stream can include authentication data, payload data, and variousother data elements. As indicated by block 115, the data stream 114 isembedded in the elements 112A of image 112 creating a new image 116,which has identifiable elements 116A. The elements 112A and the elements116A have different values; however, they can be identified or pickedout of all of the other elements in images 112 and 116, because theselection criteria uses a property which is invariant between theoriginal elements and the elements that have been changed by theembedding process.

The embedding locations having the invariant property may be used toembed auxiliary data, such as a location map, that identifies furtherembedding locations.

Some embodiments of reversible watermarking embed values of the originalimage that are changed by bit substitution during the embeddingoperation as part of the auxiliary data stream. This is not required inall cases because some embedding operations, like the expansionembedding method, are invertible without storing original data valuesand can be made at some locations in a manner that retains the invariantproperty.

An inverse transform 117 (i.e. a transform that is the inverse of thetransform 111) can be applied to image 116 to generate an embedded image118 (i.e. an image with the auxiliary data embedded in it). The image118 is shown with a shaded corner to indicate that image 118 includesembedded auxiliary data.

The auxiliary data reading and image re-creation process is illustratedin block diagram form in FIG. 1F. First as illustrated by block 121, atransform is applied to the image with embedded data 118. The transform121 is identical to the transform 111. Application of transform 121produces a transformed image 116, which has identifiable elements 116A.These elements are identified using the same invariant criteria 123. Asindicated by block 125, the data stream 114 is extracted from elements116A. As indicated by block 126, the data from stream 114 is used torestore the transformed values of the image to their original valuesprior to auxiliary data embedding. In certain cases, this process ofrestoring the original values of the transformed data occurs as part ofthe auxiliary data extraction process of block 125. In other cases,certain changed bit values of elements 116A are replaced with originalbit values carried in the auxiliary data stream. It is not necessary tocarry original values of the image data in the auxiliary data streamwhen using embedding techniques, like expansion, that are invertiblewithout requiring the auxiliary data to include the changed bits of theoriginal image. As indicated by block 127, an inverse of transform 121is applied to re-generate the original image now which is designated110A in FIG. 1F. Not specifically shown in FIG. 1F, is the fact thatdata stream 114 can include a hash of the original image 110. One cangenerate a hash of the recreated original image 110A and compare it tothe hash in data stream 114, to insure or guarantee that the image hasbeen re-created precisely.

In certain embodiments of our reversible watermarking method, aninvertible transform divides the pixels in an image into pairs or groupsof pairs according to a particular pattern. Factors to be considered inchoosing these patterns include, for example, retaining perceptualquality of the image after embedding, increasing data capacity, etc.FIG. 2A illustrates (in greatly exaggerated form) the individual pixelsin an image. Only a small portion of an image is shown. As is wellknown, any practical image would include many thousand such pixels. Forconvenience of illustration only a relatively few pixels are shown inFIG. 2A. It is also noted that in certain embodiments only the luminancevalues of the pixels are embedded with data. That is, the image isviewed as a gray scale image. Naturally, in color images there wouldalso be color values. It should be understood that the digital watermarkcould alternatively be placed in other aspects of the image such as inthe various color components and other transform domain sample value,like frequency domain values.

The purpose of FIG. 2A is to illustrate that the pixels are grouped intopairs in this example embodiment. For example, as shown in FIG. 2A,pixel C and D belong to the same pair. Any pattern of grouping can beused; however, the same pattern must be used in both the embedding andin the reading operations. While any pattern of paired pixels can beused, it is advantageous to use pairs that probably have similar values,that is, pairs that probably will have small difference numbers. Thus,in the preferred embodiment, adjacent pixels were chosen for members ofeach pair. In FIG. 2A, an alternating horizontal and vertical patternwas chosen to illustrate that the pattern can have a wide variety ofarrangements.

In certain embodiments using difference expansion, two numbers arecalculated for each pair of values in the image:

-   -   a) The average value of the two pixels, and    -   b) The difference between the values of the two pixels.

Transforming the image representation from a representation with anarray of pixel values to a representation with an array of differenceand average numbers is just one example of a transform or filter asindicated by block 111 in FIG. 1E. Other transformations may be madebefore this transform to place the original data in a format forembedding in other domains (e.g., a transform to a frequency domain, atransform a feature set, such as autocorrelation values or otherstatistical values).

In order to facilitate a discussion of additional embodiments, thefollowing terms are defined as follows:

-   -   Average value: the average value of a group of two or more        values.    -   Difference value: the difference between selected values in the        group    -   Expandable value: a value that can be expanded without causing        an overflow or underflow.    -   Expanded value: a value that has been expanded.    -   Changeable value: all expandable values and values that can be        changed by bit substitution without causing an overflow or        underflow.

These definitions are used only for the sake of explaining certainembodiments, and are not intended to be limiting.

FIG. 2B illustrates difference values A to Z to show examples of thevarious types of difference values that can exist in an image.Difference values A and C are difference values that are not changeable.Difference values B and Z are changeable, but not expandable. They havecertain bits designated Bc and Zc that may be changed by bitsubstitution. Difference values D and E are expandable.

As a simple example consider the following. If a pair of pixels hasgrayscale values (61,76), the average value of the pair is 68.5 and thedifference is 15. Only the integer part of the average, namely 68, needbe considered. This integer part is computed using the floor function,for example. The difference value 15 can be expressed as a binary numberwith a minimum length. In such a representation, all leading “0”s in thebinary representation are discarded. That is, the difference number 15can be expressed as the binary number 1111.

With this example, a bit can be inserted in the difference number 1111without causing an overflow. That is, where the difference number is1111 and a 0 is inserted after the first 1, the number becomes 10111 or23.

Given an average of 68.5 and a difference of 23, the pair of pixels musthave the value 57 and 80. The average of 57 and 80 is 68.5 and thedifference is 23. The above numbers may be easier to follow with thefollowing table.

Pixel Difference value values Average Difference in binary 61, 76 68.515 1111 57, 80 68.5 23 10111

It is noted other pairs of pixels values could have an average of 68;however, only the values 57 and 80 have an average of 68 (ignoring thefractional portion) and a difference of 23.

The following is another simple example to illustrate differenceexpansion. Assume that one has two grayscale values x=205 and y=200. Wewill illustrate below how one can embed one bit b=1, in a reversibleway. First the integer average value l and the difference value “h” of xand y are computed as follows:

$l = {\left\lfloor \frac{x + y}{2} \right\rfloor = {\left\lfloor \frac{205 + 200}{2} \right\rfloor = {\left\lfloor \frac{405}{2} \right\rfloor = 202}}}$h = x − y = 205 − 200 = 5

It is noted that the symbol └ ┘ is the floor function meaning “thegreatest integer less than or equal to”. For example └2.7┘=2, and└−5.2┘=−6.

Next we represent the difference number h in its binary representation:h=5=101₂

Then we append b which equals 1 into the binary representation of hafter the least significant bit (LSB), the new difference number h′ willbe:h′=101b₂=1011₂=11

The above is equivalent to:h′=2×h+b=2×5+1=11

Finally we can compute the new grayscale values, based on the newdifference number h′ and the original average number l,

$x^{\prime} = {{l + \left\lfloor \frac{h^{\prime} + 1}{2} \right\rfloor} = {{202 + \left\lfloor \frac{11 + 1}{2} \right\rfloor} = 208}}$$y^{\prime} = {{l - \left\lfloor \frac{h^{\prime}}{2} \right\rfloor} = {{202 - \left\lfloor \frac{11}{2} \right\rfloor} = 197}}$

From the embedded pair x′,y′, we can extract the embedded bit b andrestore the original pair x, y. To do this we again compute the integeraverage and difference as follows:

$l^{\prime} = {\left\lfloor \frac{x^{\prime} + y^{\prime}}{2} \right\rfloor = {\left\lfloor \frac{208 + 197}{2} \right\rfloor = 202}}$h^(′) = x^(′) − y^(′) = 208 − 197 = 11

We now look at the binary representation of h′h′=11=1011₂

From the above we extract the LSB, which in this case is 1, as theembedded bit b which leaves the original value of the difference numberas:h=101₂=5the above is equivalent to:

$\begin{matrix}{{b = {{{LSB}\left( h^{\prime} \right)} = 1}},} & {h = {\left\lfloor \frac{h^{\prime}}{2} \right\rfloor = 5.}}\end{matrix}$

With the original average value l and the restored difference number h,we can restore exactly the original grayscale valued pair, x,y.

In the above example, although the embedded pair (208, 197) is still 8bits per pixel (bpp), one bit b has been embedded by increasing thevalid bit length of the difference number h from 3 bits (for h=5) to 4bits (for h′=11). This reversible data embedding operation h′=2×h+b iscalled difference expansion.

The reason that the valid bit length of the difference numbers h can beincreased in images is because of the redundancy that exists in thepixel values of natural images. In most cases h will be very small andhave a short valid bit length in its binary representation. However, inan edge area or an area containing lots of activity, the differencenumber h from a pair of grayscale values could be large. For example, ifx=105, and y=22, then h=x−y=83. In such a situation if one wanted toembed a bit 0 into h by difference expansion, then h′=2×h+b=166. WithI=63 being unchanged, the embedded pair will be x′=146 y′=−20. This willcause an underflow problem since grayscale values can only be in therange of [0, 255]. In the specific embodiments discussed below, thegrayscale values selected for expansion are those grayscale values thatcan be expanded without causing an overflow or underflow condition.

The overall process used to watermark an image is illustrated in blockdiagram form in FIG. 3 and the overall process used to read a watermarkand re-create an image is illustrated in FIG. 4. Each block in FIGS. 3and 4 can be a subroutine in a program or digital circuit, oralternatively, a number of blocks can be performed by a single programsubroutine or digital circuit.

As indicated by block 300, the process begins with an image which onewants to embed auxiliary data (e.g., a digital watermark). It is notedthat in other embodiments, one could start with other types of data. Forexample, instead of starting with an image, one might start with adigitized file of audio data, video data, software, graphical model(e.g., polygonal mesh), etc.

As a first step (block 301) a hash number or other authentication datais generated for the image. This can be calculated by known techniquesfor calculating a hash number. It is noted that the size of a hash ismuch smaller than the size of the image. It is not necessarily a uniqueidentification. However, a hash can authenticate an image with a veryhigh confidence level.

Block 302 indicates that a pattern of pixel pairs is selected. It isdesirable (but not absolutely necessary) that the values in each pairtend to be similar. The selection pattern illustrated in FIG. 2A is oneexample of selected pairs. Adjacent pairs have been selected since theymore likely have relatively similar values. However, the particularpattern selected is arbitrary and a wide variety of different patternscould be used.

Next, as indicated by block 303, for each pair of pixels, two values arecalculated. The average of the two pixel values of the pair iscalculated and the difference between the pixel values in the pair iscalculated.

The values of the pixel in each pair are then examined and the followingis determined:

-   a) Those pairs that can be expanded without causing an overflow or    underflow.-   b) Those pairs that cannot be expanded, but which have bits that can    be changed by bit substitution without causing an overflow or    underflow.-   c) Those pairs that do not fall into groups “a” or “b.”

Various embodiments are described in detail below for selecting theexpandable pairs. Note that the difference values of the pairs in sets“a” and “b” are both changeable in some fashion (by expansion or by bitsubstitution). The set of “changeable” difference values can be limitedto those that have an invariant property to the embedding operation sothat the decoder can identify embedding locations without use of dataseparate from the watermarked data.

As indicated by blocks 305 and 306, the particular pairs that will beexpanded is determined and a location map is made which indicates whichpairs will be expanded. For example, one simple way of making a locationmap is to have one bit for each pair that indicates whether the pair isexpandable. Another way to make a location map is to store the indexvalues of either the pairs that can be expanded or the indexes of thepairs that can not be expanded.

Next as indicated by block 307, a data stream (called the embedded datastream) is created. The embedded data stream may include:

-   a) The desired payload data (i.e. data which one desires to store in    the watermark).-   b) The location map (in some embodiments, the location map is    compressed).-   c) The original bits changed by bit substitution, and-   d) A hash number of the original image.

As indicated by block 308, the embedder embeds the auxiliary data streamusing expansion (and in some cases, bit substitution). For certainexpandable difference values, the embedder expands the difference valueby multiplying the difference value by the desired number of states andadding the desired state. For example, in the case of two states, theembedder multiplies the expandable difference value by 2, shifting thebit positions toward the MSB, and the embedded bit value (0 or 1) isadded in the bit position vacated by the shift. As indicated by block309, the new difference values along with the original average valuesare used to calculate new values for each pair. In certain cases, theembedder replaces bits in certain difference values (e.g., those in set“b”) by certain bits from the embedded data stream using bitsubstitution. The result is a watermarked image 310.

FIG. 4 shows auxiliary data decoder operations in the process of readingthe auxiliary data and recreating the original, un-watermarked image.First as indicated by block 401, the values in the watermarked image aregrouped into pairs using the same pattern as was used during thewatermarking process. Next (block 402) the average and difference valueof the pairs are calculated.

The changeable difference values are determined (block 403). The decodercan identify these values using a property invariant to the embeddingoperation, or using separate data (e.g., a separate location map).

As indicated by block 404, the changeable difference values areselected, and an auxiliary data stream is extracted. In this case, theauxiliary data embedded by expansion and by bit substitution is carriedin the LSBs of the difference values, and as such, is easily separatedfrom the changeable difference values. This extracted data is theembedded data stream previously discussed. The embedded data streamincludes:

-   -   1) The payload    -   2) The location map that tells which pairs have been expanded        (if not provided separately).    -   3) The original value of any bits, if any, changed by bit        substitution    -   4) a hash of the original image (or other authentication data).

The length and position of each component in the embedded data stream isknown (or it can be determined), hence, the embedded data stream can beseparated into its component parts.

Block 406 indicates that the bits changed by bit substitution arereplaced with the original bits in the embedded data stream. Thelocation map is used to tell which pairs have been expanded. Asindicated by block 406, the difference numbers for the pairs areprocessed in sequence. For each pair, any bits changed by bitsubstitution are replaced by corresponding original bits from theembedded data stream. If the location map indicates that a particularpair was expanded, the difference values are restored to their originalvalues by inverting the expansion operation. For the case of binaryembedding states, this operation shifts the bit positions back to theiroriginal position.

Finally, new values for each pair are calculated from the average valuesand the restored difference values for each pair (block 407). These newvalues are the newly re-created image as indicated by block 408.

As a final step, a hash number for the re-created image is calculatedand compared to the hash number that was in the embedded data stream. Ifthe two numbers match, the original image has been re-created perfectly.

Several specific embodiments of the invention will now be described inconsiderable mathematical detail. It is noted that in the followingdiscussion, some equations are referred to by the number in parenthesesthat is to the right of the equation.

Details of First Specific Preferred Embodiment

The following is a more detailed description of a first specificpreferred embodiment of the invention. This embodiment provides a highcapacity and high quality reversible watermarking method based ondifference expansion. A feature of the method is that it does notinvolve compressing original values of the embedding area.

The method described here can be applied to digital audio and video aswell. This embodiment performs steps similar to those in FIG. 3. Thatis, the difference between neighboring pixel values are calculated(block 303). Some difference numbers are selected for differenceexpansion (block 305). The original values of difference numbers, thelocation of expanded difference numbers, and a payload are all embeddedinto the difference numbers (308). Extra storage space is obtained bydifference expansion.

The described embodiment pertains to grayscale images. There are severaloptions by which the technique can be applied to color images. One cande-correlate the dependence among different color components, and thenreversibly watermark the de-correlated components. Or one can reversiblywatermark each color component individually.

In this embodiment, a watermark is embedded in a digital image I, tocreate a watermarked image I′. The reversible watermark can be removedfrom I′ to re-create the original image. The recreated image is calledI″. One can determine if the image I′ was tampered with by someintentional or unintentional attack. This is done by comparing a hash ofthe original image I to a hash of the re-created image I″. If there wasno tampering, the retrieved image I″ is exactly the same as the originalimage I, pixel by pixel, bit by bit.

The basic approach is to select an area of an image for embedding, andembed the payload. Difference expansion is used to embed the values inthe image, and this eliminates the need for loss-less compression. Thedifference expansion technique discovers extra storage space byexploring the high redundancy in the image content.

This embodiment embeds the payload in the difference of neighboringpixel values. For a pair of pixels (x, y) in a grayscale image, x, yεZ,0≦x, y≦255, we define their average and difference as

$\begin{matrix}\begin{matrix}{{l = \left\lfloor \frac{x + y}{2} \right\rfloor},} & {h = {x - y}}\end{matrix} & (1)\end{matrix}$where the symbol └·┘ is the floor function meaning “the greatest integerless than or equal to”. The inverse transform of (equation 1 above) is:

$\begin{matrix}\begin{matrix}{{x = {l + \left\lfloor \frac{h + 1}{2} \right\rfloor}},} & {y = {l - \left\lfloor \frac{h}{2} \right\rfloor}}\end{matrix} & (2)\end{matrix}$

As grayscale values are bounded in [0,255], we have:

$0 \leq {l + \left\lfloor \frac{h + 1}{2} \right\rfloor} \leq {255\text{,}0} \leq {l - \left\lfloor \frac{h}{2} \right\rfloor} \leq 255$which is equivalent to:

$\begin{matrix}{{h} \leq {\min\;\left( {{2\left( {255 - l} \right)},{{2l} + 1}} \right)}} & (3)\end{matrix}$

Thus to prevent overflow and underflow problems, the difference number h(after embedding) satisfies Condition (3).

The least significant bit (LSB) of the difference number h will be theselected embedding area. As

$h = {{\left\lfloor \frac{h}{2} \right\rfloor \cdot 2} + {{LSB}(h)}}$with LSB(h)=0 or 1, to prevent any overflow and underflow problems, weembed only in changeable difference numbers.

Definition of Changeable values: For a grayscale-valued pair (x, y), wesay h is changeable if:

${{{\left\lfloor \frac{h}{2} \right\rfloor \cdot 2} + b}} \leq {\min\;\left( {{2\left( {255 - l} \right)},{{2l} + 1}} \right)}$for both b=0 and 1.

Using bit substitution for changeable h does not provide additionalstorage space. We gain extra storage space from expandable differencenumbers.

Definition of Expandable values: For a grayscale-valued pair (x, y), wesay h is expandable if

2 ⋅ h + b ≤ min  (2(255 − l), 2l + 1)for both b=0 and 1.

In the binary representation of integers, an expandable h could add oneextra bit b after its LSB, with b=0 or 1. More precisely, h could bereplaced by a new difference number h′=2h+b, without causing an overflowor underflow. Thus, for each expandable difference number, one couldgain one extra bit. The reversible operation from h to h′ is calleddifference expansion. An expandable h is also changeable. Afterdifference expansion, the expanded h′ is still changeable.

With this embodiment, more difference numbers will be changeable and/orexpandable than in the fourth embodiment. Also note that if h=0 or −1,the conditions on changeable and expandable are exactly the same.

When this embodiment is applied to a digital image, the image ispartitioned into pairs of pixel values. A pair comprises two pixelvalues or two pixels with a relatively small difference number. Thepairing can be done horizontally, vertically, or by a key-based specificpattern. The pairing can be through all pixels of the image or just aportion of it. The integer transform (1) is applied to each pair. (it isnoted that one can embed a payload with one pairing, then on theembedded image, we can embed another payload with another pairing, andso on.)

After applying transform 1, five disjoint sets of difference numbers,EZ, NZ, EN, CNE, and NC are created:

-   -   1. EZ: expandable zeros. For all expandable hε{0,−1}    -   2. NZ: not expandable zeros. For all not expandable hε{0,−1}    -   3. EN: expandable nonzeros. For all expandable h∉{0,−1}    -   4. CNE: changeable, but not expandable. For all changeable, but        not expandable h∉{0,−1}    -   5. NC: not changeable. For all not changeable h∉{0,−1}

Each difference number will fall into one and only one of the abovesets.

The next step is to create a location map of all expanded (afterembedding) difference numbers as indicated by block 306 in FIG. 3. Wepartition the set EN into two disjoint subset EN1 and EN2. Every h inEN1, will be expanded; and every h in EN2, will not be expanded (thoughit is expandable). A discussion on how to select expandable h∉{0,−1} fordifference expansion is given below. We create a one-bit bitmap, withits size equal to the numbers of pairs of pixel values. For thedifference number in either EZ or EN1, we assign a value “1” in thebitmap; for the difference number in either NZ, EN2, CNE, or NC, weassign a value “0”. Thus a value “1” will indicate an expandeddifference number. The location map will be lossless compressed by aJBIG2 compression or run-length coding. The compressed bit stream willbe denoted as L. An end of message symbol is appended at the end of L.

We collect original LSB values of difference numbers in EN2 and CNE. Foreach h in EN2 or CNE, LSB(h) will be collected into a bit stream C. Anexception is when h=1 or −2, nothing will be collected.

With the location map L, the original LSB values C, and a payload P(which includes an authentication hash, for example, an SHA-256 hash),we combine them together into one binary bit stream BB=L∪C∪P

Assuming b is the next bit in B, depending on which set h belongs to,the embedding (by replacement) will be

-   -   EZ or EN1: h=2·h+b

$\;{{{EN2}\mspace{14mu}{or}\mspace{14mu}{{CNE}:\mspace{14mu} h}} = {{\left\lfloor \frac{h}{2} \right\rfloor \cdot 2} + b}}$

-   -   NZ or NC: no change on the value of h, b is passed to the next h

After all bits in B are embedded, we apply the inverse integer transform(2) to obtain the embedded image.

The bit stream B has a bit length of (|L|+|C|+|P|). Assume the totalnumber of 1 and −2 in EN2 and CNE is N, as each expanded pair will giveone extra bit. The total hiding capacity will be (|C|+N+|EZ|+|EN1|).Accordingly, to have B successfully embedded, we must have:

$\begin{matrix}{{{L} + {C} + {P}} \leq {{C} + N + {{EZ}} + {{EN1}}}} & (4) \\{{i.e.},} & \; \\{{{L} + {P}} \leq {N + {{EZ}} + {{EN1}}}} & (5)\end{matrix}$

Note that if the bit stream C is loss-lessly compressed beforeembedding, then Condition (4) becomes

L + α C + P ≤ C + N + EZ + EN1

-   -   where α is the achieved compression rate, 0<α≦1.

The partition of expandable h∉{0,−1} into EN1 and EN2 will be subject toCondition (5). We will give two designs, one for mean square error (MSE)consideration, and the other for visual quality consideration.

Assume after difference expansion, an expanded pair (x, y) becomes (x′,y′), with the average number unchanged,

$\begin{matrix}{{\left( {x - x^{\prime}} \right)^{2} + \left( {y - y^{\prime}} \right)^{2}} \approx {2\left( {y - y^{\prime}} \right)^{2}}} \\{= {2\left( {\left\lfloor \frac{h}{2} \right\rfloor - \left\lfloor \frac{h^{\prime}}{2} \right\rfloor} \right)^{2}}} \\{= {2\left( {\left\lfloor \frac{h}{2} \right\rfloor - \left\lfloor \frac{{2 \cdot h} + b}{2} \right\rfloor} \right)^{2}}} \\{\approx \frac{h^{2}}{2}}\end{matrix}$

Thus to minimize the mean square error, one should select h with smallmagnitudes for difference expansion. For example, one can pick athreshold T, and partition EN into EN1 and EN2 by checking whether themagnitude of h is less than or greater than T.

For the visual quality consideration, one can define a hiding ability ofan expandable difference number, as follows.

Definition For an expandable difference number h, if k is the largestnumber such that:

k ⋅ h + b ≤ min (2(255 − l), 2l + 1)

-   -   for all 0≦b≦k−1, then we say the hiding ability of h is log₂ k.

The hiding ability tells us how many bits could be embedded into thedifference number h without causing overflow and underflow. Thus for anexpandable difference number h, it will be at least log₂ 2=1, since k≧2.The hiding ability could be used as a guide on selecting expandabledifference numbers. In general, selecting an expandable differencenumber with large hiding ability will degrade less on the visual qualitythan an expandable difference number with small hiding ability. A largehiding ability implies that the average of two pixel values is close tomid tone, while their difference is close to zero.

For decoding, we do the pairing using the same pattern as in theembedding, and apply the integer transform (1) to each pair. Next wecreate two disjoint sets of difference numbers, C, and NC:

-   -   1. C: changeable. For all changeable h    -   2. NC: not changeable. For all not changeable h

Then we collect all LSBs of difference numbers in C and form a binarybit stream B. From B, we first decode the location map. With thelocation map, we restore the original values of difference numbers asfollows (assuming b is the next bit from B):

-   -   if hεC, the location map value is 1, then

${h = \left\lfloor \frac{h}{2} \right\rfloor},$

-   -    b is passed to the next h    -   if hεC, the location map value is 0, and 0≦h≦1, then h=1, b is        passed to the next h    -   if hεC, the location map value is 0, and −2≦h≦−1, then h=−2, b        is passed to the next h    -   if hεC, the location map value is 0, and h≧2 or h≦−3, then

$h = {{\left\lfloor \frac{h}{2} \right\rfloor \cdot 2} + b}$

-   -   if h∉C, the location map value should be 0 (otherwise a decoding        error on a tampered image), no change on h, b is passed to the        next h

After all difference numbers have been restored, we apply the inverseinteger transform (2) to reconstruct a restored image. If the embeddedimage has not been tampered, then the restored image will be identicalto the original image. To authenticate the content of the embeddedimage, we extract the embedded payload P from B, and compare theauthentication hash in P with the hash of the restored image. If theymatch exactly, then the image content is authentic, and the restoredimage will be exactly the same as the original image. Most likely, atampered image will not go through to this step because some decodingerror could happen in restoring difference numbers. This decoding errorindicates that the image has been tampered.

The above described embodiment provides a high capacity, high quality,reversible watermarking method. The method partitions an image intopairs of pixel values (block 302 in FIG. 3), selects expandabledifference numbers for difference expansion (block 305 in FIG. 3) andembeds a payload that includes authentication data (e.g., block 308 inFIG. 3). By exploring the redundancy in the image, reversibility isachieved. As difference expansion brings extra storage space,compression is not necessary. Of course, employing compression caneither increase the hiding capacity or reduce the visual qualitydegradation of watermarked image.

Detail of Second Embodiment

The following is a detailed explanation of a second embodiment of theinvention. This embodiment involves a reversible data embedding methodfor digital images. However, the method can be applied to digital audioand video as well. This embodiment is an example of expansion using Nstates for auxiliary data values to be embedded, where the state Ncorresponds to the level number L.

In this embodiment, two mathematical techniques are utilized, namely,difference expansion and Generalized Least Significant Bit (G-LSB)embedding. This embodiment achieves a very high embedding capacity,while keeping the distortion low.

In this embodiment, as in the first embodiment, the differences ofneighboring pixel values are calculated, and some difference numbers areselected for difference expansion. The original G-LSBs values of thedifference numbers, the location of expanded difference numbers, and apayload (which includes an authentication hash of the original image)may all be embedded into the difference numbers as indicated by bloc 308in FIG. 3. The needed extra storage space is obtained by differenceexpansion. With this embodiment, no compression is used.

This embodiment relates to watermarking a grayscale image. For colorimages, one can embed the data into each color component individually.Alternatively one can de-correlate the dependence among different colorcomponents, and then embed the data into the de-correlated components.

The overall operation is as follows: a payload is embedded in a digitalimage I, to create an embedded image I′. An image I″ is retrieved fromthe embedded image I′. The retrieved image I″ is identical to theoriginal image I, pixel by pixel, bit by bit. One can determine if theimage I′ was tampered with by some intentional or unintentional attackusing a content authenticator. The authenticator compares a hash of theoriginal image I to a hash of the retrieved image I″.

This embodiment uses a reversible integer transform.

The image being watermarked comprises grayscale-valued pairs (x, y).

Each x and y has a value from 0 to 255.

-   -   that is x, yεZ, 0≦x, y≦255.

The average value “I” and difference value “h” of the pairs is defined

$\begin{matrix}\begin{matrix}{{l = \left\lfloor \frac{x + y}{2} \right\rfloor},} & {h = {x - y}}\end{matrix} & (21)\end{matrix}$where the symbol └ ┘ is the floor function meaning “the greatest integerless than or equal to”. The inverse transform of equation 1 is:

$\begin{matrix}{\begin{matrix}{{x = {l + \left\lfloor \frac{h + 1}{2} \right\rfloor}},} & {y = {l -}}\end{matrix}\left\lfloor \frac{h}{2} \right\rfloor} & (22)\end{matrix}$

In some of the literature, the reversible transform given in equations21 and 22 above is called the Haar wavelet transform or the S transform.

The magnitude of the difference number h is used for embedding. Sincegrayscale values are in the range of 0 to 255,

$\begin{matrix}{{0 \leq {l + \left\lfloor \frac{h + 1}{2} \right\rfloor} \leq 255},} & {0 \leq {l - \left\lfloor \frac{h}{2} \right\rfloor} \leq 255}\end{matrix}$which is equivalent to:

$\begin{matrix}{{h} \leq {\min\left( {{2\left( {255 - l} \right)},{{2l} + 1}} \right)}} & (23)\end{matrix}$

Thus to prevent overflow and underflow problems, the difference number h(after embedding) satisfies Condition (23).

Given an integer L, Lε, L≧2. the (L-level) G-LSB, g, of a differencenumber h, is the remainder of its magnitude after dividing by L,

$g:={{h} - {\left\lfloor \frac{h}{L} \right\rfloor \cdot L}}$

The G-LSB g is the selected embedding area for this embodiment. In orderto prevent any overflow and underflow problems during embedding,embedding only takes place in the changeable difference numbers definedas follows:

For a grayscale-valued pair (x,y), the difference number h isL-changeable if:

${{\left\lfloor \frac{h}{L} \right\rfloor \cdot L} + 1} \leq {\min\left( {{2\left( {255 - l} \right)},{{2l} + 1}} \right)}$

During data embedding, the G-LSB g might be replaced by a value from theremainder set {0, 1, . . . L−1}. In view of constraint set out inequation 23 above, some large remainders might cause an overflow or anunderflow. Thus we replace g with a value from the partial remainder set{0, 1 . . . M}, with

-   -   g≦M≦L−1, where M is determined by: I and

$\left\lfloor \frac{h}{L} \right\rfloor$

It is noted that modifying G-LSBs of L-changeable h (withoutcompression) does not provide extra storage space. With this embodiment,extra storage space is gained from the expandable difference numbers.

In this embodiment, for a particular grayscale pair (x,y), a differencenumber h is called L-expandable if:

h ⋅ L + 1 ≤ min (2(255 − l), 2l + 1)

In a base L representation, an L-expandable h can add one extra number bafter its G-LSB. More precisely, h could be replaced by a new differencenumber h′, without causing an overflow or underflow where h′ is definedby:

h^(′) = sign(h) ⋅ (h ⋅ L + b)

Again, due to the constraint in equation 23 above, b could be a valuefrom a partial remainder set {0, 1, . . . M) with 1≦M≦L−1 and M isdetermined by I and

$\left\lfloor \frac{h}{l} \right\rfloor.$

Thus, for each L-expandable difference number, one could gain log₂(M+1)extra bits. The reversible operation h to h′ is termed “differenceexpansion”. An L-expandable h is also L-changeable. After differenceexpansion, the expanded h′ is still L-changeable.

For h<0, we can alternatively define L-changeable (and L-expandable) as:

${{\left\lfloor \frac{h}{L} \right\rfloor \cdot L} + 1} \leq {\min\left( {{2\left( {255 - l} \right)},{{2l} + 1}} \right)}$

The Embedding Algorithm: A watermark is embedded in an image using theabove described technique using the following procedure. First, Theimage is partitioned into pairs of pixel values as indicated by block302 in FIG. 3. A pair of pixels comprises two neighboring pixel valuesor two pixels with a small difference number as indicated in FIG. 2A.The pairing could be through all pixels of the image or just a portionof it. The integer transform (equation 21) is applied to each pair.

In order to achieve maximum embedding capacity, one can embed a payloadwith one pairing, then embed another payload with another pairing on theembedded image. For example, we could embed column wise first, thenembed row wise.

After applying the integer transform (equation 21) to each pair, fivesets of difference numbers designated EZ, NZ, EN, CNE, and NC arecreated using the above definitions of changeable and L-expandable asfollows:

-   1. EZ: expandable zeros. For all L-expandable where h=0.-   2. NZ: not expandable zeros. For all not L-expandable where h=0.-   3. EN: expandable non zeros. For all L-expandable h≠0.-   4. CNE: changeable, but not expandable. For all L-changeable, but    not L-expandable h≠0.-   5. NC: not changeable. For all not L-changeable h≠0.

Each difference number will fall into one and only one of the abovesets.

The next step (block 306 in FIG. 3) is to create a location map of allexpanded (after embedding) difference numbers. The set EN is partitionedinto two disjoint subset EN1 and EN2. Every h in EN1, will be expanded;every h in EN2, will not be expanded. (It is noted that to achievemaximum embedding capacity, EN1 would include the whole set EN, and EN2will be empty).

A one-bit bitmap is created. Its size is equal to the numbers of pairsof pixel values (block 302 in FIG. 3). For an h in either EN1 or EZ, avalue 1 is assigned in the bitmap; otherwise a 0 is assigned. Thus, avalue 1 indicates an expanded difference number. The location map isthen loss less compressed by a JBIG2 compression or by run lengthcoding. The compressed bit stream is denoted as L′. An end of messagesymbol is appended at the end of L′.

Next, we collect the original values of G-LSBs of the difference numbersin EN2 and CNE. For each h in EN2 or CNE, its G-LSB g is collected intoa bit stream C. We employ a conventional L-ary to Binary conversionmethod to convert g to a binary bit stream.

The L-ary to Binary conversion is a division scheme of unit interval,similar to arithmetic coding. Since h is L-changeable, we determine M,where g could be replaced by a value from {0, 1, . . . M} withoutcausing an overflow or underflow. We convert g to the interval:

$\left. \left\lbrack {\frac{g}{M + 1} \cdot \frac{g + 1}{M + 1}} \right. \right)$

The interval is further refined by the next G-LSBs, and so on, until wereach the last G-LSB. Then we decode the final interval to a binary bitstream. By using L-ary to Binary conversion, instead of simply using afixed length binary representation of g, the representation of G-LSBs ismore compact, which results in a smaller bit stream size of C.

It is noted that when L=2, as M will always be 1, there will be no needfor the L-ary to Binary conversion. It is also noted that if |h|≦L−1,after its g is collected, we also store its sign, sign(h), in the bitstream C.

Finally, (as indicated by block 308 in FIG. 3) we embed the location mapL′, the original values of G-LSBs C, and a payload P (which includes anauthentication hash, for example, an SHA-256 hash). We combine themtogether into one binary bit stream S,S=L′∪C∪P

We use the inverse L-ary to Binary conversion to convert the binary bitstream S to M-ary, with M determined for each expandable differencenumber in EZ and EN1, and each changeable difference number in EN2 andCNE. The embedding (by replacement) is:

-   -   EZ: IhI =b, where b is the M-ary symbol from the inverse L-ary        to Binary conversion, and the sign of h is assigned pseudo        randomly.    -   EN1: h=sign(h)·(IhI ·L+b).

$\mspace{14mu}{{{EN2}\mspace{14mu}{or}\mspace{14mu}{{CNE}:\mspace{14mu} h}} = {{{sign}(h)} \cdot {\left( {{\left\lfloor \frac{h}{L} \right\rfloor \cdot L} + b} \right).}}}$

-   -   NZ or NC: no change on the value of h.

After all embedding is done, we apply the inverse integer transform(equation 22) to obtain the embedded image.

The Decoding Algorithm: The decoding process uses the same principles asthe embedding process. First, we do pairing of pixels using the samepattern as in the embedding as indicated by block 401 in FIG. 4. Theinteger transform (equation 21) is applied to each pair.

Next two disjoint sets of difference numbers, C, and NC are created asfollows:

-   -   1. C: changeable. For all L-changeable h.    -   2. NC: not changeable. For all not L-changeable h.

Next we collect all G-LSBs of difference numbers in C. We employ theL-ary to Binary conversion to convert it into a binary bit stream B.From the binary bit stream, we first decode the location map. With thelocation map, we restore the original values of difference numbers asfollows:

-   -   a) if hεC, and the location map value is 1, then

$h = {{{sign}(h)} \cdot \left\lfloor \frac{h}{L} \right\rfloor}$

-   -   b) if hεC, and the location map value is 0, and h=0, decode an        M-ary symbol b from B, and decode a sign value s from B, then        h=s·b.    -   c) if hεC, the location map value is 0, and 1≦IhI≦L−1,    -   then h=sign(h)·b, and the next sign value from B should        correctly match sign(h).    -   d) if hεC, the location map value is 0, and IhI>L,

$h = {{{sign}(h)} \cdot \left( {{\left\lfloor \frac{h}{L} \right\rfloor \cdot L} + b} \right)}$

-   -   e) if hεNC, the location map value should be 0, no change on the        value of h.

After all difference numbers have been restored, we apply the inverseinteger transform (equation 22) to reconstruct a restored image. If theembedded image has not been tampered, then the restored image will beidentical to the original image. To authenticate the content of theembedded image, we extract the embedded payload P from B. Theauthentication hash in P is compared with the hash of the restoredimage. If they match exactly, then the image content is authentic, andthe restored image will be exactly the same as the original image. (Mostlikely a tampered image would not go through to this step because somedecoding error could happen before this step indicating a tamperedimage.)

For the maximum embedding capacity all expandable difference numbers(EN1=EN) are expanded and the location map is loss less compressed byJBIG2. For more capacity and for other reasons, one can first embed withthe column wise pairing, then embed with the row wise pairing on thecolumn wisely embedded image.

To embed a payload with a smaller size than the maximum embeddingcapacity, one can reduce the size of EN1, until the targeted embeddingcapacity is met. For example, to embed a payload of 138856 bits in aparticular image in which there are 116029 expandable non-zeros at L=2with column wise pairing. One can assign 106635 of them in EN1, and therest in EN2. The PSNR of the embedded image is then higher than someother methods with a payload of the same size.

The above described embodiment provides a high capacity reversible dataembedding algorithm. The difference expansion provides extra storagespace, and compression on original values of the embedding area is notneeded. With compression (such as a linear prediction and entropycoding), the maximum embedding capacity will be even higher, at theexpanse of complexity.

Third Embodiment

The third embodiment uses the same reversible integer transform as usedin the first and second embodiment and which is given by equations 1,21, 2 and 22 above. Furthermore to prevent overflow and underflowconditions:

${0 \leq {l + \left\lfloor \frac{h + 1}{2} \right\rfloor} \leq 255},{{{and}\mspace{14mu} 0} \leq {l - \left\lfloor \frac{h}{2} \right\rfloor} \leq 255}$since l and h are integers, the above is equivalent to:

$\begin{matrix}{{{h^{\prime}} \leq {2\left( {255 - l} \right)}},{{{and}\mspace{14mu}{h}} \leq {{2l} + 1}}} & (33)\end{matrix}$

Condition (33) sets a limit on the magnitude (absolute value) of thedifference number h. As long as h is in such range, it is guaranteedthat (x, y) computed from Equation 2 or 22 will be a grayscale value.Condition given by equations 33 above are equivalent to:

$\begin{matrix}{{{h^{\prime}} \leq {2\left( {255 - l} \right)}},{{{if}\mspace{14mu} 128} \leq l \leq 255}} \\{{{h} \leq {{2l} + 1}},{{{if}\mspace{14mu} 0} \leq l \leq 127}}\end{matrix}$

For this embodiment Expandable and Changeable difference numbers aredefined as follows: When a bit b is embedded into a difference number hby difference expansion, the new difference number h′ is:h′=2×h+b

In accordance with equation 33 above, in order to prevent overflow andunderflow, h′ must satisfy the following conditions.

h ≤ min (2(255 − l), 2 l _ + 1

Definition of Expandable Difference number: for a grayscale-valued pair(x,y), which are members of a set Z and where 0≦x, y≦255, we define theaverage and difference:

${l = \left\lfloor \frac{x + y}{2} \right\rfloor},{h = {x - y}}$as previously explained

The difference number h is expandable under I for both b=0 and 1 if:

2 × h + b ≤ Min(2(255 − l), 2l + 1)

It is noted that since an expansion does not change the average numberl, so for simplicity and brevity, we say h is expandable, as anabbreviation of saying h is expandable under l.

For an expandable difference number h, if we embed a bit by differenceexpansion, the new difference number h′ still satisfied conditions 33.so the new pair computed from equation 2 above is guaranteed to be agrayscale value. Thus expandable difference numbers are candidates fordifference expansion.

As each integer can be represented by the sum of a multiple of 2, andits LSB (least significant bit), for new, expanded difference number h′:

${\begin{matrix}{h^{\prime} = {{2 \times \left\lfloor \frac{h^{\prime}}{2} \right\rfloor} + {{LSB}\left( h^{\prime} \right)}}} & {with}\end{matrix}\mspace{14mu}{{LSB}\left( h^{\prime} \right)}} = {0\mspace{14mu}{or}\mspace{14mu} 1.}$

If we modify its LSB:

$g = {{2 \times \left\lfloor \frac{h^{\prime}}{2} \right\rfloor} + b^{\prime}}$with b′=0 or 1, then

${g} = {{{{2 \times \left\lfloor \frac{h^{\prime}}{2} \right\rfloor} + b^{\prime}}} = {{{{2 \times \left\lfloor \frac{{2 \times h} + b}{2} \right\rfloor} + b^{\prime}}} = {{{{2 \times h} + b^{\prime}}} \leq {\min\left( {{2\left( {255 - l} \right)},{{2l} + 1}} \right)}}}}$

Thus after difference expansion, the new difference number h′ could haveits LSB modified, without causing an overflow or underflow. We call sucha difference number changeable.

Definition of Changeable difference number: for a grayscale-valued pair(x,y), which are members of a set Z and where 0≦x, y≦255, we define theaverage l and difference h as:

${l = \left\lfloor \frac{x + y}{2} \right\rfloor},{h = {x - y}}$as previously explained

In this embodiment, the difference number h id defined as changeable if:

${{{2 \times \left\lfloor \frac{h}{2} \right\rfloor} + b}} \leq {\min\left( {{2\left( {255 - l} \right)},{{2l} + 1}} \right)}$for both b=0 and 1/

From the above it follows that:

-   1) If a difference number h is a positive odd number or a negative    even number, it is always changeable.-   2) For a changeable difference number, after its LSB is modified, it    is still changeable.-   3) An expandable difference number h is always changeable.-   4) After difference expansion, the new difference number h′ is    changeable.-   5) If h=0 or −1, the conditions on expandable and changeable are    equivalent.

The Location Map: One can select some expandable difference numbers, andembed one bit into each of them. However to extract the embedded dataand restore the original grayscale values, the decoder needs to knowwhich difference numbers has been selected for difference expansion. Tofacilitate identification of expanded values, we can embed such locationinformation, such that the decoder could access and employ it fordecoding. For this purpose, we create and embed a location map, whichincludes the location information of all selected expandable differencenumbers.

The data embedding Algorithm: The location map allows the encoder andthe decoder to share the same information concerning which differencenumbers have been selected for difference expansion. While it isstraightforward for the encoder, the decoder needs to know where (fromwhich difference numbers) to collect and decode the location map.

After difference expansion, the new difference number h′ might not beexpandable. On the decoder side, to check whether h′ is expandable doesnot tell whether the original h has been selected for differenceexpansion during embedding. As we know, the new difference number h′ ischangeable, so the decoder could examine each changeable differencenumber. With the technique described here, the encoder selectschangeable difference numbers as the embedding area. The decoder usesthe same data to decode. During data embedding, all changeabledifference numbers are changed, by either adding a new LSB (viadifference expansion) or modifying its LSB. To guarantee an exactrecovery of the original image, we will embed the original values ofthose modified LSBs.

In brief, data embedding algorithm used by this embodiment includes sixsteps: calculating the difference numbers, partitioning differencenumbers into four sets, creating a location map, collecting original LSBvalues, data embedding by expansion, and finally an inverse integertransform. Each of these steps is discussed below.

The original image is grouped into pairs of pixel values. A paircomprises two neighboring pixel values or two with a small differencenumber. The pairing could be done horizontally by pairing the pixels onthe same row and consecutive columns; or vertically on the same columnand consecutive rows; or by a key-based specific pattern. For example,FIG. 2A show a pairing pattern that could be utilized. The pairing couldbe through all pixels of the image or just a portion of it.

The integer transform (equation 1 above) is applied to each pair. Thenwe design a scanning order for all the difference numbers h, and orderthem as a one dimensional list {h₁, h₂, . . . h_(M)}.

Next, four disjoint sets of difference numbers are created, namely

-   -   EZ, EN, CNE, and NC:

-   1) EZ: expandable zeros (and minus ones). For all expandable h=0 and    expandable h=−1.

-   2) EN: expandable non-zeros. For all expandable h that are not a    member of the set {0,−1}

-   3) CNE: changeable, but not expandable. For all changeable, but    non-expandable h.

-   4) NC: not changeable. For all non-changeable h.

Each difference number will fall into one and only one of the above foursets. Since an expandable difference number is always changeable, thewhole set of expandable difference numbers is EZ∪EN, and the whole setof changeable difference numbers is EZ∪EN∪CNE.

The third step is to create a location map of selected expandabledifference numbers. For a difference number h in EZ, it will always beselected for difference expansion. For EN, we partition it into twodisjoint subset EN1 and EN2. For every h in EN1, it will be selected fordifference expansion; for every h in EN2, it will not (though it isexpandable). A discussion on how to partition EN is given below. Aone-bit bitmap is created vas the location map, with its size equal tothe numbers of pairs of pixel values (in Step 1). For example, if we usehorizontal pairing through all pixels, the location map will have thesame height as the image, and half the width. For an h in either EZ orEN1, we assign a value 1 in the location map; for an h in EN2, CNE, orNC, we assign a value 0. Thus a value 1 will indicate a selectedexpandable difference number. The location map will be losslesscompressed by a JBIG2 compression or run-length coding. The compressedbit stream is denoted as L. An end of message symbol is at the end of L.

In the fourth step, the original LSB values of difference numbers arecollected in EN2 and CNE. For each h in EN2 or CNE, LSB(h) will becollected into a bit stream C. An exception is when h=1 or −2, nothingwill be collected, as its original LSB value (1 and 0, respectively)could be determined by the location map information. (see the decodingsection below for an explanation).

Fifth, we embed the location map L, the original LSB values C, and apayload. The payload P includes an authentication hash (for example, a256 bits SHA-256 hash). The payload size (bit length) is limited by theembedding capacity limit discussed below. We combine L, C, and Ptogether into one binary bit stream B,B=L∪C∪P=b₁,b₂ . . . b_(M)where: b_(i)ε{0,1},1≦i≦m,m is the bit length of B. We append C to theend of L and append P to the end of C. The bit stream B is embedded intothe difference numbers as follows.

1) Set i − 1 and j 0. 2) While (i ≦ m) • j = j + 1. • If h_(j) ε EZ orh_(j) ε EN1 • h_(j) = 2 × h_(j) | b_(i). • i = i + 1. • Elseif h_(j) εEN2 or h_(j) ε CNE • h_(j) = 2 × [h₂/h] + b_(i). • i = i + 1. 3) End

Only changeable difference numbers (set EZ∪EN∪CNE) are modified,non-changeable difference numbers and all average numbers are unchanged.For a changeable difference number, either a new LSB is embedded bydifference expansion (if it is in EZ or EN1) or its original LSB isreplaced (if it is in EN2 or CNE). Thus after embedding, all theembedded information are in the LSBs of changeable difference numbers.By collecting the LSBs of changeable difference numbers, the decoderwill be able to recover the embedded bit stream B

Finally after all the bits in B are embedded, the inverse integertransform (equation 2 above) is applied to obtain the embedded(watermarked) image.

Capacity Limit: The bit stream B has a bit length of (|L|+|C|+|P| where|.| is the cardinality (bit length or numbers of elements) of a set. Thetotal embedding capacity is

(EZ + EN1 + EN2 + CNE).

For successful embedding we must have:

L + C + P ≤ EZ + EN1 + EN2 + CNE

Assume the total number of 1 and −2 in EN2 and CNE is N, then

$\begin{matrix}{{P} \leq {{{EZ}} + {{EN1}} + N - {L}}} & (35)\end{matrix}$

The payload size is upper bounded by the sum of the number of selectedexpandable difference numbers and the number of not selected or notexpandable hε{1,−2}, minus the bit length of the location map.

Difference Number Selection: Due to the redundancy in pixel values ofnatural images, the difference numbers of neighboring pixel values areusually small. For a pair of two pixel values, if their integer averageis in the range of [30, 225], and their difference number is in therange of [−29, 29], then:

$\begin{matrix}\left. {{\left. {2 \times h} \middle| b \right.} \leq {{2 \times {h}} + {b}} \leq {2 \times 29}} \middle| 1 \right. \\{{= {59 < 60 \leq {\min\left( {{2\left( {255 - l} \right)},{{2l} + 1}} \right)}}},}\end{matrix}$for both b=0 and 1, and the difference number h is expandable.

Since most integer averages and difference numbers will be in suchranges, most difference numbers will be expandable. We have found that,in general, many natural grayscale images usually have over 99%expandable difference numbers. If all expandable difference numbers areselected for difference expansion, the location map is very compressible(as over 99% values are 1), the embedding capacity limit will be closeto 0.5 bpp. When the payload has a bit length less than the capacitylimit, we only need to select some expandable difference numbers fordifference expansion.

With a given payload P, the selection of expandable difference numbersin EN for difference expansion is constrained by condition (35) above.We present two simple selection methods here, one for mean square error(MSE) consideration, and the other for visual quality consideration.

For a grayscale-valued pair (x, y), assume the new grayscale valued pairafter difference expansion is (x′, y′). Since the average number I isunchanged, and we have:

(x − x^(′))² − (y − y^(′))² ≈ 2 × (y − y^(′))² $\begin{matrix}{= {2 \times \left( {\left( {l - \left\lfloor \frac{h}{2} \right\rfloor} \right) - \left( {l - \left\lfloor \frac{h^{\prime}}{2} \right\rfloor} \right)} \right)^{3}}} \\{= {2 \times \left( {\left\lfloor \frac{h}{2} \right\rfloor - \left\lfloor \frac{h^{\prime}}{2} \right\rfloor} \right)^{3}}} \\{= {{2 \times \left( {\left\lfloor \frac{h}{2} \right\rfloor - \left\lfloor \frac{{2 \times h} + b}{2} \right\rfloor} \right)^{2}} \approx {\frac{h^{2}}{2}.}}}\end{matrix}$

Thus the Euclidean distance between the original pair (x, y) and thenew, expanded pair (x′, y′) is proportional to the difference number h(before difference expansion). To minimize the MSE between the originalimage and the embedded image, we should select h with small magnitudesfor difference expansion. We choose a threshold T, and partition EN intoEN1 and EN2 by

EN1 = {h ∈ EN : h ≤ T}, EN2 = {h ∈ EN : h > T}.

For a payload P, we start with a small threshold T, then increase Tgradually until Condition (35) above is met. One could preprocess animage and create a threshold vs. capacity limit table, by calculating(|EZ|+|EN1|+N−|L|). When proceeding to embed a payload, one could checkthis table and pick an appropriate threshold.

For the visual quality consideration, we can define a hiding ability ofan expandable difference number, as follows. If k is the largest integersuch that:

k × h + b ≤ min (2(255 − l), 2l + 1),for all 0≦b≦k−1, we can say the hiding ability of h is log₂ k.

For a difference number h with hiding ability log₂ k, we can replace hwith a new difference number k×h+b, where bε{0 . . . k−1}, withoutcausing an overflow or underflow. This means we could reversibly embedlog₂ k bits. For an expandable difference number, as k will be at least2, its hiding ability will be at least log₂ 2=1. Although with thisembodiment we do not embed more than one bit into a difference number,the hiding ability could be used as a guide on selecting expandabledifference numbers for difference expansion.

In general, selecting an expandable difference number with large hidingability will degrade less on the visual quality than an expandabledifference number with small hiding ability. A large hiding abilityimplies that the average of two pixel values is close to mid tone, whiletheir difference is close to zero. Again we can choose a threshold T,and partition EN into EN1 and EN2 by:

$\begin{matrix}{{{EN1} = \left\{ {h \in {{EN}:{{{HidingAbility}\mspace{11mu}(h)} \geq T}}} \right\}},} \\{{EN2} = {\left\{ {h \in {{EN}:{{{HidingAbility}\mspace{11mu}(h)} < T}}} \right\}.}}\end{matrix}$

It should be noted that with a different threshold T in the above twoselection methods, the location map L also changes, so does its bitlength C. Thus a third method to partition EN could be based on thecompressibility of the location map. We could select expandabledifference numbers such that the location map is more compressible bylossless compression.

JBIG2 Compression: The location map (before loseless compression) is aone-bit bitmap. It can be efficiently compressed by JBIG2, the newinternational standard for lossless compression of bi-level images.JBIG2 supports model-based coding to permit compression ratios up tothree times those of previous standards for lossless compression. Formore details on JBIG2, we refer to an article by P. G. Howard, F.Kossentini, B. Martins, S. Forchammer, and W. J. Rucklidge, “Theemerging JBIG2 standard” IEEE Transactions on Circuits and systems forVideo Technology, vol. 8, no. 7 pp 838-848, 1998. For our reversibledata embedding method, we can employ a slightly modified and morecompact JBIG2 encoder and decoder, as we can discard most of the headerinformation in the standard JBIG2 bit stream.

It should be noted that the last two bytes of the JBIG2 bit stream arethe end of message symbol. The second to last byte will always be 255,and the last byte will be greater than 143 (it is 173 in a JBIG2 bitstream from Power JBIG-2 encoder developed by the University of BritishColumbia). With the end of message symbol, our decoder can separate thelocation map C from the next bit stream C easily.

Multiple Embeddinq: It is possible to employ the technique describedhere to an image more than once for multiple embedding. For an alreadyembedded image, we can embed it again with another payload. Even for onepayload, we can divide the payload into several pieces and use multipleembedding to embed them. As we have a choice of pairing of pixel valuesin Step 1 during embedding, we can use a different pairing for eachembedding. One approach is to use a complement pairing. For example, ifthe image is embedded with a horizontal pairing, then we can use avertical pairing for the next embedding. Other approaches are alsopossible. As each embedding has an embedding capacity limit less than0.5 bpp, a multiple embedding will have an embedding capacity limit lessthan M/2 bpp, where M is the number of embedding.

In order to assist the decoder to determine whether or not there hasbeen multiple embedding, one can embed header information before thelocation map G. The bit stream B now becomes:B=′H∪L∪C∪P,where H is a 16 bit header. For the original image (first embedding), His set to 0. The pairing pattern of the original image will be the H atthe second embedding. The pairing pattern of the second embedding willbe the H at the third embedding, and so on. For a 16 bit H we have2¹⁶−1=65535 different pairing patterns to choose from.

Security: For security, the bit stream B can be encrypted by theAdvanced Encryption Standard (AES) algorithm prior to embedding.

Decoding and authentication: The LSBs of changeable difference numbersare collected from the bit stream B. By collecting LSBs of allchangeable difference numbers, we can retrieve the bit stream B. From B,we can decode the location map L and the original LSBs values C. Thelocation map gives the location information of all expanded differencenumbers. For expanded difference numbers, an (integer) division by 2will give back its original value; for other changeable differencenumbers, we restore their original LSB values from the bit stream C.After all changeable difference numbers have restored their originalvalues, we can restore the original image exactly, as non-changeabledifference numbers and all average numbers are unchanged duringembedding.

The decoding and authentication process consists of five steps. First wecalculate the difference numbers. For a (possibly) embedded (andpossibly tampered) image, we do the pairing using the same pattern as inthe embedding, and apply the integer transform (1) to each pair. We usethe same scanning order to order all difference numbers as a onedimensional list {h₁, h₂, . . . h_(M)}.

Next we create two disjoint sets of difference numbers, C, and NC:

-   -   1) C: changeable. For all changeable h.    -   2) NC: not changeable. For all non-changeable h.

Note that we do not need to examine expandability at the decoder.

Third we collect all LSB values of difference numbers in C, and form abinary bit stream B=b₁b₂ . . . b_(m).

Fourth, we decode the location map from B by JBIG2 decoder. Since theJBIG2 bit stream has an end of message symbol at its end, the decoderknows exactly the location in B, where it is the last bit from theembedded location map bit stream L.

In this embodiment, we assume the first s bits in B are the location mapbit stream L (including the end of message symbol). Thus the embeddedoriginal LSB values C starts from the (s+1)-th bit in B. We restore theoriginal values of difference numbers as follows.

1) Set i = s + 1. 2) For j = 1:n . If h_(j) ∈ C . If the location mapvalue is h_(j) is 1 .$h_{j} = {\left\lfloor \frac{h_{j}}{2} \right\rfloor.}$ . Else . If (0 ≦h_(j) ≦ 1) . h_(j) = 1. . Elseif (−2 ≦ h_(j) ≦ −1) . h_(j) = −2. . Else.$h_{j} = {{2 \times \left\lfloor \frac{h_{j}}{2} \right\rfloor} + {b_{i}.}}$. i = i + 1. 3) End

If the location map value is 1, the difference number has been expandedduring embedding. Conversely, for a non-changeable difference number,its location map value must be 0, otherwise the image has been tampered.

For a changeable difference number h, if its location map value is 0,then its original value will be differed from h by LSB. If 0≦h≦1, theoriginal value of h must be 1. The reason is that the original valuecould be only either 0 or 1, as it is differed from h by LSB. If theoriginal value of h was 0, then it would be an expandable zero (aschangeable zero is expandable), and its location map value would be 1,which contradicts the fact that the location map value is 0. Similarlyif −2≦h≦−1, the original value of h must be −2. For other changeabledifference numbers, we restore their original LSB values from theembedded bit stream C.

The fifth and last step is content authentication and original contentrestoration. After all difference numbers have been restored to theiroriginal values, we apply the inverse integer transform (2) toreconstruct a restored image. To authenticate the content of theembedded image, we extract the embedded payload P from B (which will bethe remaining after restoring difference numbers). We compare theauthentication hash in P with the hash of the restored image. If theymatch exactly, then the image content is authentic, and the restoredimage will be exactly the same as the original image. (Most likely atampered image will not go through to this step because some decodingerror could happen in Step 4, as a non-changeable difference numbermight have a location map value 1 or a syntax error in JBIG2 bitstream.)

The decoding and authentication process for this embodiment operates asfollows: It reconstructs a restored image I″ from the embedded image I′,then authenticates the content of I′ by comparing the hash of therestored image I″ and the decoded hash in P. If I′ is authentic, thenthe restored image I″ will be exactly the same as the original image I.

For multiple embedding, the first 16 bits in B is the pairing pattern H.After the first 16 bits are extracted, we decode the location map,reconstruct a restored image, and authenticate the content. If thecontent is authentic, we use H as the pairing pattern to decode therestored image again. The decoding process continues until H=0 or untiltampering has been discovered (either a hash mismatch, JBIG2 decodingerror, or wrong location map value). If H=0, and no tampering has beendiscovered during the whole decoding process, then the final restoredimage will be exactly the same as the original image, pixel by pixel,bit by bit.

Fourth Embodiment

This embodiment provides a reversible watermarking method of digitalimages. While the embodiment specifically applies the method to adigital image, the method can be applied to digital audio and video aswell. This embodiment employs an integer wavelet transform to losslesslyremove redundancy in a digital image to allocate space for watermarkembedding. The embedding algorithm starts with a reversible colorconversion transform. Then, it applies the integer wavelet transform toone (or more) de-correlated component(s). The purpose of both thereversible color conversion transform and the integer wavelet transformis to remove irregular redundancy in the digital image, such that we canembed regular redundancy into the digital image, for the purpose ofcontent authentication and original content recovery. The regularredundancy could be a hash of the image, a compressed bit stream of theimage, or some other image content dependent watermark. In the integerwavelet domain, we look into the binary representation of each waveletcoefficient and embed an extra bit into an “expandable” waveletcoefficient. Besides original content retrieval bit streams, an SHA-256hash of the original image will also be embedded for authenticationpurposes. The method used in this embodiment is based on an integerwavelet transform, JBIG2 compression, and arithmetic coding.

The following is a simple example that illustrates the process. Assumethat we have two grayscale values (x,y), where x,yεZ, 0≦x,y≦255, andthat we would like to embed one bit b with bε{0, 1} into (x.y) in areversible way. More specifically let us assume:x=205, y=200, and b=0

First we compute the average l and difference h of and y:

$\begin{matrix}{{l = {\left\lfloor \frac{x + y}{2} \right\rfloor = {\left\lfloor \frac{205 + 200}{2} \right\rfloor = 202}}},} & {h = {{x - y} = {{205 - 200} = 5}}}\end{matrix}$

It is noted that the symbol └ ┘ demotes the integer part of a number.For Example:└2.71┘=2, └−1.2┘=−2

Next we expand the difference number h into its binary representation:h=5=101₂

Then we add b into the binary representation of h at the location rightafter the most significant bit (MSB). It is noted that the MSB is always1.h′=1b01₂=1001_(2.)=9

Finally we computer the new grayscale values, based on the newdifference number h′ and the original average value number l:

$\begin{matrix}{{x^{\prime} = {{l + \left\lfloor \frac{h^{\prime} + 1}{2} \right\rfloor} = {{202 + \left\lfloor \frac{9 + 1}{2} \right\rfloor} = 207}}},} & {y^{\prime} = {{x^{\prime} - h^{\prime}} = {{207 - 9} = 198}}}\end{matrix}$

From the embedded pair (x′,y′), the watermark detector can extract theembedded bit b and get back the original pair (x,y) by a process similarto the embedding process. Again, we compute the average and difference:

$\begin{matrix}{{l^{\prime} = {\left\lfloor \frac{x^{\prime} + y^{\prime}}{2} \right\rfloor = 202}},} & {h^{\prime} = {{x^{\prime} - y^{\prime}} = {{207 - 198} = 9}}}\end{matrix}$

The binary representation of h′ is:h′=9=1001₂

Extracting the second most significant bit, which is “0”, as theembedded bit b which leaves: h″=101₂=5

Now with the average l′ and difference h″, we can retrieve exactly theoriginal grayscale value pair (x,y).

In the above example, although the embedded pair (207, 198) is still 8bpp, we have embedded an extra bit by increasing the bit length of thedifference number h from 3 bits (which is the number 5) to 4 bits (whichis the number 9). Such an embedding process is totally reversible.

Stated in a general manner: If we have a sequence of pairs of grayscalevalues

-   -   (x₁, y₁),(x₂, y₂) . . . , (x_(n), y_(n)) where x_(i), y_(i)εZ,        0≦x_(i), y_(i)≦255, l≦i≦n one can embed the payload: b={b₁, b₂ .        . . b_(n)} where b_(i)ε{0,1}, 1≦i≦n by repeating the above        process,

${l_{i} = \left\lfloor 2^{\underset{\_}{x_{i} + y_{i}}} \right\rfloor},{h_{i} = {x_{i} - y_{i}}},{1 \leq i \leq {n.}}$

For each difference number h_(i) expand it to a binary representation:

h_(i) = r_(i, 0)r_(i, 1)…  r_(i, j(i))where r_(i,0)=1 is the MSB, r_(i,m)ε{0,1}, for 1≦m≦j(i). with j(i)+1 asthe bit length of h, in its binary representation. Then we could embedb_(i) into h_(i) by

h_(i)^(′) = r_(i, 0)b_(i)r_(i, 1)…  r_(i, j(i)).

Alternatively, we can combine all the bits r_(i,m)ε{0.1}, with 1≦m≦j(i),1≦I≦n and b={b_(i).} into a single bit stream. Note, that we do notselect the MSBs.

B = r_(1, 1)r_(1, 2)…  r_(1, j(1))r_(2, 1)r_(2, 2)…  r_(2, j(2))…  r_(n, 1)r_(n, 2)…  r_(n, j(n))b₁b₂…  b_(n),and use a reversible mapping ƒ which could be encryption, loss-lesscompression, or other invertible operations or a combination of suchoperations to form a new bit stream C:C=ƒ(B)=c ₁ c ₂ . . . c _(k)where c_(i)ε{0, 1}, for 1≦i≦k, with k as the bit length of C. Then wecould embed C into the difference numbers h_(i), 1≦i≦n by

h_(i)^(′) = r_(i, 0)c_(s(i − 1) + 1)c_(s(i − 1) + 2)…  c_(s(i))where:

c_(s(i − 1) + 1)c_(s(i − 1) + 2)…  c_(s(i))is a truncated subsequence of C with:s(0)=0, and s(i)=s(i−1)+j(i)+1

The length of h_(i)′ is still one than that of h_(i). For detection ƒ isreversible, we can get back B by ƒ⁻¹(C),

and consequently, we can get back the original pairs (x₁, y₁),(x₂, y₂) .. . , (x_(n), y_(n))

The reason we could increase the bit length of the difference number ofan image is because of the high redundancy in pixels values of naturalimages. Thus, in most cases h will be very small and have a short bitlength in its binary representation. In an edge area containing lots ofactivity, the difference number h from a pair of grayscale values couldbe large. For example if x=105, y=22, the h=x−y=83=1010011₂. If we embeda bit “0” into h, h′=10010011₂=147. with l=63 unchanged, the embeddedpair will be x′=137, y′=−10. This will cause an underflow problem asgrayscale values are restricted to the range [0,255]. Below we providedefinition of “expandable pairs”, which will prevent overflow andunderflow problems.

Reversible color conversion: The reversible color conversion transformdiscussed below de-correlates the dependence among different colorcomponents to a large extent. It is a loss-less color transform and thetransform output is still integer-valued. For a RGB color image, thereversible color conversion transform is:

$\begin{matrix}{{{Yr} = \left\lfloor \frac{R + {2G} + B}{4} \right\rfloor},} \\{{{Ur} = {R - G}},} \\{{Vr} = {B - {G.}}}\end{matrix}$

Its inverse transform will be:

$\begin{matrix}{{G = {{Yr} - \left\lfloor \frac{{Ur} + {Vr}}{4} \right\rfloor}},} \\{{R = {{Ur} + G}},} \\{B = {{Vr} + {G.}}}\end{matrix}$

The reversible color conversion transform maps a grayscale valuedtriplet to an integer triplet. It can be thought of as an integerapproximation of the CCIR 601 standard which provides a conversion toYcrCb space defined by the following matrix.

$\begin{pmatrix}Y \\{Cr} \\{Cb}\end{pmatrix} = {\begin{pmatrix}0.299 & 0.587 & 0.114 \\0.500 & {- 0.419} & {- 0.081} \\{- 0.169} & {- 0.331} & 0.500\end{pmatrix}{\begin{pmatrix}R \\G \\B\end{pmatrix}.}}$

The RGB to YCrCb transform matrix is not integer-valued. It requiresfloating point computing. Such a transform will introduce small roundoff errors, and will not be a reversible transform. Since reversiblewatermarking requires original retrieval with 100% accuracy, we use thereversible color conversion transform instead of the RGB to YcrCbtransform.

For a grayscale image there will be no reversible color conversiontransform since we apply the integer wavelet transform directly.

Integer Wavelet Transform: The integer wavelet transform maps integersto integers and allows for perfect invertibility with finite precisionarithmetic (i.e. reversible). The wavelet filters for integer wavelettransforms are dyadic rational, i.e., integers or rational numbers whosedenominators are powers of 2, like 13/4, −837/32. Thus the integerwavelet transform can be implemented with only three operations,addition, subtraction, and shift, on a digital computer. The fastmultiplication-free implementation is another advantage of the integerwavelet transform over standard discrete wavelet transform.

For example, for the Haar wavelet filter, the integer wavelet transformwill be the average and difference calculation.

$\begin{matrix}{{l_{i} = \left\lfloor \frac{x_{2i} + x_{{2i} + 1}}{2} \right\rfloor},} & {h_{i} = {x_{2i} - {x_{{2i} + 1}.}}}\end{matrix}$

And for a biorthogonal filter pair with four vanishing moments for allfour filters, the integer wavelet transform will be:

$\left. {{\begin{matrix}{{h_{i} = {x_{{2i} + 1} - \left\lfloor {{\frac{9}{16}\left( {x_{2i} + x_{{2i} + 2}} \right)} - {\frac{1}{16}\left( {x_{{2i} - 2} + x_{{2i} + 4}} \right)} + \frac{1}{2}} \right\rfloor}},} & {l_{i} = {x_{2i} + \left\lfloor \frac{9}{32} \right.}}\end{matrix}\left( {h_{i - 1} + h_{i}} \right)} - {\frac{1}{32}\left( {h_{i - 2} + h_{i + 1}} \right)} + \frac{1}{2}} \right\rfloor.$

In this embodiment, we use will the Haar integer wavelet transform. Thegeneralization to other integer wavelet transforms is understandablefrom this example.

After the reversible color conversion transform, we apply the integerwavelet transform to one (or more) de-correlated component. In thisembodiment, we choose the Yr component, which is the luminancecomponent. For a grayscale image, one can apply the integer wavelettransform directly to the whole image.

Expandable Wavelet Coefficient: For the grayscale-valued pair (105, 22)and a payload bit “0” (or “1”), a brute-force embedding will cause anunderflow problem. Now we will show how to prevent the overflow andunderflow problems.

For a grayscale-valued pair (x, y), where x, yεZ, 0≦x, y≦255, define theaverage and difference as:

$\begin{matrix}{{l:=\left\lfloor \frac{x + y}{2} \right\rfloor},} & {h:={x - {y.}}}\end{matrix}$

Then the inverse transform to get back (x, y) from the average number land difference number h is:

$\begin{matrix}\begin{matrix}{{x = {l + \left\lfloor \frac{h + 1}{2} \right\rfloor}},} & {y = {l - {\left\lfloor \frac{h}{2} \right\rfloor.}}}\end{matrix} & (41)\end{matrix}$

Thus to prevent the overflow and underflow problems, i.e., to restrictx, y in the range of [0, 255] is equivalent to have:

${\begin{matrix}{{0 \leq {l + \left\lfloor \frac{h + 1}{2} \right\rfloor} \leq 255},} & {0 \leq {l -}}\end{matrix}\left\lfloor \frac{h}{2} \right\rfloor} \leq 255.$

Since both l and h are integers, one can derive that the aboveinequalities are equivalent to:

$\begin{matrix}\begin{matrix}{{{h} \leq {2\left( {255 - l} \right)}},} & {{{and}\mspace{14mu}{h}} \leq {{2l} + 1.}}\end{matrix} & (42)\end{matrix}$

Condition (42) above sets a limit on the absolute value of thedifference number h. As long as h is in such range, it is guaranteedthat (x, y) computed from Eqn. (41) will be grayscale values.Furthermore, Condition (42) is equivalent to

$\left\{ {\begin{matrix}{{{h} \leq {2\left( {255 - l} \right)}},} & {{{if}\mspace{14mu} 128} \leq l \leq 255} \\{{{{h} \leq {{2l} + 1}},}\mspace{40mu}} & {{{{if}\mspace{14mu} 0} \leq l \leq 127}\mspace{25mu}}\end{matrix}\quad} \right.$

With the above condition, we now define an expandable grayscale-valuedpair.

Definition: For a grayscale-valued pair (x, y), where x, yεZ, 0≦x,y≦255, define

$\begin{matrix}{{l = \left\lfloor \frac{x + y}{2} \right\rfloor},} & {h = {x - {y.}}}\end{matrix}\mspace{76mu}$

Then (x, y) is an expandable pair if and only if

h ≠ 0, and  2^(⌊log₂h⌋ + 2) − 1 ≤ min (2(255 − l), 2l + 1).

Note that if h≠0, the bit length of the binary representation of h is└log₂|h|┘+1 . . .

Thus

2^(⌊log₂h⌋ + 2) − 1is the largest number whose bit length is one more than that of |h|.Thus for an expandable pair (x, y), if we embed an extra bit (“0” or“1”) into the binary representation of the difference number h at thelocation right after the MSB, the new difference number h′ stillsatisfies Condition (42), that is, the new pair computed from Eqn. (41)is guaranteed to be grayscale values. For simplicity, we will also callh expandable if (x, y) is an expandable pair.

Thus from the average number l, one can tell whether or not a differencenumber h is expandable, i.e., whether or not the bit length of h couldbe increased by 1 without causing any overflow or underflow problem.Further we define the changeable bits of h as:

Definition: For a grayscale-valued pair (x, y), assume h≠0, and thebinary representation of |h| is:|h|=r ₀ r ₁ . . . r _(j),where: r₀=1, r_(m)ε{0,1}, for 1≦m≦j, wih j≧0 and j+1 is the bit length.If g≦j is the largest number:

${{\left( {\sum\limits_{i = 0}^{j - g}\;{r_{i}2^{j - i}}} \right) + 2^{g} - 1} \leq {\min\left( {{2\left( {255 - l} \right)},{{2l} + 1}} \right)}},$then we say (x.y), or equivalently h, has g changeable bits, and theyare:

τ_(j − g + 1), τ_(j − g + 2), … , τ_(j).

Since:

${|h| = {{\tau_{0}\tau_{1}{\ldots\tau}_{j}} = {\sum\limits_{i = 0}^{j}{\tau_{i}2^{j - i}}}}},$by definition, h has g changeable bits if the last g bits in the binaryrepresentation are all changed to “1”, it still satisfies Condition(42), or the new pair computed from Eqn. (41) is still grayscale values.Let's look at two extreme cases:

-   -   If g=0, then h has no changeable bits.    -   If g=j, then all bits (excluding the MSB) in its binary        representation are changeable. It is clear that if h is        expandable, then g=j. However the inverse is not true, i.e., g=j        does not imply h is expandable.

The number “0” does not have a proper binary representation. We canincrease it (along with all positive numbers) by 1 to fit it into thedefinition of expandable and changeable. With such preparation, weextract bits from wavelet coefficients as follows:

-   -   1. For the Yr component of a color image or a grayscale image,        apply the integer wavelet transform.    -   2. If h_(i)≧0 and l_(i)<255, we increase h_(i) by 1,        h_(i)=h_(i)+1.    -   3. Construct a bit stream R, which consists of changeable bits        from all h_(i). The scanning order of h_(i) is determined by a        fixed pattern (for example, zigzag).

JBIG2 Compression: For a grayscale-valued pair (x, y), by the abovedefinition we can tell whether or not it is expandable. When (x, y) hasbeen modified by the embedder, it will not be clear to the watermarkdetector whether or not the original pair has been expanded, i.e.,whether the bit length of the binary representation of the differencenumber has been increased by 1 (thus larger than the original one), orit is the same as the original one. In order to remove the watermark andretrieve the original, un-watermarked image, the detector needs to knowthe location of expanded difference numbers h in the original image.

We can define a location map of expanded difference numbers by settingits value to “1” at each location when it is expanded or “0” otherwise.The location map can be viewed as a bi-level image. To store thelocation map, we can losslessly compress the bi-level image and storethe compressed bit stream instead. We will employ JBIG2, the newinternational standard for lossless compression of bi-level images, tocompress the location map of expanded difference numbers h. Forconvenience, we will denote the JBIG2 compressed bit stream of thelocation map of expanded h as J. Alternatively, the location map couldbe compressed by run-length coding.

Arithmetic Coding: To make more room for embedding the payload, we canfurther losslessly compress the collected bit stream R, which are allthe changeable bits from difference numbers h. Either arithmetic codingor Huffman coding could be used for this purpose. In this embodiment.,we use arithmetic codingC=ArithmeticCoding(R)where C is the compressed bit stream from the arithmetic coding.

SHA-256 Hash: To authenticate a watermarked image and detect tampering,we embed a hash of the image into itself. The new hash algorithm SHA-256is a 256-bit hash function that is intended to provide 128 bits ofsecurity against collision attacks. SHA-256 is more consistent with thenew encryption standard, the Advanced Encryption Standard (AES)algorithm, than SHA-1, which provides no more than 80 bits of securityagainst collision attacks. We calculate the SHA-256 hash of the digitalimage (before the reversible color conversion transform) and denote thehash as H.

Embedding: With the compressed bit stream J of the location map, thecompressed bit stream C of changeable bits, and the SHA-256 hash H (a256 bit stream), we are ready to embed all three of sets into changeablebits of difference numbers h in the integer wavelet domain. First wecombine the sets into one big bit stream:

S = J⋃C⋃H = s₁s₂…s_(k),where

s_(i) =  ∈ {0, 1}, 1 ≤ i ≤ kand k is the bit length of S.

As indicated above, we append C to the end of J, and append H to the endof C. The order of J, C, and H could be changed, as long as the embedderand the detector use the same order. Next we design a pseudo randomscanning order for all the difference numbers h. This pseudo randomorder will be different from the scanning order used to construct thechangeable bit stream R. With the pseudo random order of h, we embed thebit stream S into h by replacing (part of) changeable bits. Forexpandable h, we increase the bit length of h by 1, thus increase thenumber of changeable bits by 1. The following is a description of theembedding:

1. Assume all difference numbers h are ordered by the pseudo randomorder as h₁, h₂, ..., h_(n). 2. Set i = 1. 3. If ≦ n and k > 0, • Ifh_(i) is expandable, |h_(i)| = r₀r₁ ... r_(j), and g = j, • Set |h_(i)|= r₀0r₁ ... r_(j), now |h_(i)| has j + 1 changeable bits. • Replacechangeable bits in h_(i) with s_(k−g+1), s_(k−g+2), ..., s_(k). • For m= 1 : g • r_(j−g+m) = s_(k−g+m). • If h_(i) > 0, • Set h_(i) = h_(i)− 1. • Set i = i + 1, k = k − g. 4. Go to Step 3.

We modify only the absolute value of h, and keep the sign (and its MSB)unchanged. If h is non-negative, since it has been increased by 1, afterbit replacement, positive h will have its value decreased by 1.

The bit stream S is embedded by replacing changeable bits in differencenumbers h. The capacity of all changeable bits will be much larger thanthe bit length of S. For example, the capacity of all changeable bits(including expanded bits) of a particular image could be 330,000 bits,while S is about 210,000 bits. In such a case there could be about a120,000 bits surplus, which is 0.45 bpp for an image size 512×512. Thisis a huge extra space which could embed additional information (such asa compressed bit stream of the image for locating tampering andrecovery). So after embedding all bits in S, a large portion ofchangeable bits will not be changed. We can select changeable bits basedon how much difference it will introduce (how much it degrades the imagequality) if it is changed during the embedding. We will discuss twodifference cases here, non-expandable h and expandable h.

Modifying changeable bits in non-expandable h brings imperceptiblechanges to images. For example, in a sample image, if we restrictourselves by not increasing the bit length of expandable h, and modifychangeable bits only, then the worst possible distorted image is when weset changeable bits in h to be all equal to 1 or all equal to 0,depending on each h's value. In such a sample image, although the pixelvalue difference between the original and the distorted one is as largeas 32, the visual difference between them is almost imperceptible.

For expandable h, if we increase its bit length by 1 and embed one morebit into it, the visual quality degradation could be very noticeablewhen |h| is large, like in an edge area or an area containing lots ofactivity. To achieve best image quality, the extra changeable bits whichare not used for embedding should be allocated to those expandable hwith large absolute values. If |h| is large, even if h is expandable, wecan treat it as non-expandable by turning it off to “0” in the locationmap.

For security reasons, the compressed bit streams, T and C from JBIG2 andarithmetic coding can be encrypted by the AES algorithm, before they areembedded into changeable bits of difference numbers h.

Authentication: with respect to changeable bits, if we assume h has gchangeable bits, and its binary representation is:|h|=r ₀ r ₁ . . . r _(j).and if we arbitrarily change its changeable bits:

$\begin{matrix}\begin{matrix}{{\left| h^{\prime} \right| = {\tau_{0}\tau_{1}{\ldots\tau}_{j - g}\tau_{j - g + 1}^{\prime}\tau_{j - g + 2}^{\prime}{\ldots\tau}_{g}^{\prime}}},} \\{{{{where}\mspace{14mu}\tau_{j - g + i}^{\prime}} \in \left\{ {0,1} \right\}},{1 \leq i \leq g}}\end{matrix} & (45)\end{matrix}$then the new pair defined by Eqn. (41) is still grayscale-valued, andthe changeable bits of h′ is exactly g.

Since the embedder does not change the average numbers l, theauthenticator will derive exactly the same number of changeable bits inthe difference number as the embedder. For expanded h whose bit lengthof its binary representation has been increased by 1 during theembedding, the authenticator will know such information from thelocation map. Thus, the authenticator knows exactly which bits have beenreplaced and which difference numbers are expanded (by one bit) duringthe embedding process. All these are crucial to retrieve back theoriginal, un-watermarked image with 100% accuracy.

The authentication algorithm is similar to the embedding algorithm. Theauthentication algorithm goes through a reversible color conversiontransform and the integer wavelet transform. From wavelet coefficients,it extracts all changeable bits, ordered by the same pseudo random orderof the embedding. From the first segment of extracted bits, itdecompress the location map of expanded difference numbers h. From thesecond segment, it decompresses the original changeable bits values. Thethird segment will give the embedded hash. From equation (45) above, oneknows which bits are modified and which bits are extra expanded bitsduring the embedding. Thus one can reconstruct an image by replacingchangeable bits with decompressed changeable bits. The extracted hashand the SHA-256 hash of the reconstructed image can be compared. If theymatch bit by bit, then the watermarked image is authentic, and thereconstructed image is exactly the original, un-watermarked image.

In summary, this fourth embodiment provides a reversible watermarkingmethod based upon the integer wavelet transform. The location map ofexpanded wavelet coefficients, changeable bits of all coefficients, andan SHA-256 hash are embedded. An authenticator can remove the reversiblewatermark and retrieve an image, which is exactly the same as theoriginal image, pixel by pixel.

While several specific embodiments have been described, those skilled inthe art will realize that many alternative embodiments are possibleusing the principles described above. Furthermore the invention has awide array of uses in additions to those discussed above.

For example, the present invention could be used to encode auxiliarydata in software programs, manuals and other documentation. Thetechnique could be used for the dual function of protecting the software(e.g., the software would not run until the embedded data was extractedwith a secret key) and carrying auxiliary data related to the software,such as the manual or other program data. Alternatively, the softwaredocumentation may be embedded with executable software as the auxiliarydata using the reversible embedding method.

A reversible watermarking scheme with two or more layers of embeddedauxiliary data may be used to control the quality of distributed audio,video and still image content and control access to higher qualityversions of that content. For example, a lower quality preview editionof the content can be embedded with one or more layers of reversiblewatermarks. As the user obtains rights to higher quality versions, theuser can be provided with a key to reverse one or more layers of thereversible watermark, improving the quality of the content as each layeris removed. This approach has the advantage that the reversiblewatermark enables control of the quality, access to higher qualityversions through reversal of the watermark, and additional metadatacarrying capacity for information and executable instructions related tothe content.

A reversible watermarking scheme can also be used to distribute a keyinside of content. For example, a preview sample version of the contentcould include decryption keys to decrypt other related content.

The technique can be applied to encrypted content, where the reversiblewatermark carries decryption keys that are extracted and then used todecrypt content once the watermark has been reversed.

As explained above, one has freedom to pick pairs as one desires. Onecould choose a location map that provides the redundancy in the valuesof each pair that provides for better embedding capacity. This mightmake the location map more complex, but it would be possible.

It is noted that watermarking software with the present invention wouldin effect “introduce reversible errors” into the software. Thus, thewatermark prevents execution of the software by anyone, except those whohave the key to reverse the watermark. As such, the technique providesthe benefit of encryption with the added benefit of being able to carryextra data in the watermark.

Encryption combined with compression might achieve some of the sameeffect as the use of the reversible watermark; however, reversiblewatermarking can provide security (you need the watermark key to reversethe watermark and run the software), extra data capacity (the watermarkcan carry program related data), and compressibility (the resulting fileafter watermarking is compressible). It is noted that a watermarked filemay not be as compressible as prior to embedding.

There are a variety of ways to increase the size of the payload carriedby a watermark applied in accordance with the present invention.

-   1. One can use a triplet of pixels to embed two bits instead of a    pair of pixels to embed one bit. The following reversible transform    can be used for this purpose:

forward V0 = |_1/3(I0+U1+U2)_| V1 = U2−U1 V2 = U0−U1 reverse U1 = V0−|_1/3(V1+V2)_| U0 '2 V2+U1 U2 = V1+U1

-   2. One can apply the technique to cross spectral components. If R, G    and B are the three color component, the following reversible    transform can be used.

forward Y '2 |_1/4(R+2G+B)_| U = B−G V '2 R−G reverse G = Y−|_1/4(U+V)_| R = V+G B = U+G

-   3. One can combine (1) and (2) by applying (1) to each color    component (row then column) then apply (2) to the result.-   4. One can overlap pairs of pixels or triplets as discussed above to    increase the payload.

The four specific embodiments of the invention described above use a 2×2pixel region to maximize local other embodiments could use other sizeregions such as a 3×3 region etc.

While the invention has been explained with respect to variousembodiments and alternatives, those skilled in the art will readilyrealized that a wide array of alternative embodiments are possiblewithout departing from the spirit, scope and contribution of thisinvention. The scope of applicant's invention is limited only by theappended claims.

The following four technical papers were submitted with the applicationas originally filed, and are hereby incorporated herein in theirentireties.

-   1) “Wavelet-based reversible watermarking for authentication” by Jun    Tian SPIE ol 4675 January 2002 (this document has 12 pages).-   2) “High Capacity Reversible Data Embedding and Content    Authentication” by Jun Tian (this document has 4 pages).-   3) “Reversible Watermarking by Difference Expansion” by Jun Tian,    will be published in the Proceedings of Multimedia Security    Workshop, Dec. 6, 2002.-   4) “Reversible Data Embedding and Content Authentication Using    Difference Expansion” by Jun Tian.

1. A method of reversibly embedding auxiliary data in a data setcomprising: using a computer programmed to perform acts of: transformingthe data set from an original domain into transformed data values withan invertible transform; expanding selected data values to embedauxiliary data; inverting the transformed data values, including thedata values selected for expansion, to return the transformed datavalues to the original domain, wherein the expanding comprisestransforming the selected data values to new values that include one ormore additional data states, the one or more additional data statescarrying the auxiliary data and the new values including the selecteddata values such that the selected data values are maintained andperfectly restorable.
 2. The method of claim 1 including: identifyingdata values that can be expanded to embed auxiliary data values withoutcausing an underflow or overflow.
 3. A method of reversibly embeddingauxiliary data in a data set comprising: using a computer programmed toperform acts of: transforming the data set from an original domain intotransformed data values with an invertible transform; expanding selecteddata values to embed auxiliary data; inverting the transformed datavalues, including the data values selected for expansion, to return thetransformed data values to the original domain; wherein thetransformation includes transforming the data set into fixed andvariable values, the variable values forming a set from which certaintransformed data values are selected for expansion.
 4. The method ofclaim 3 wherein the fixed values remain unchanged during the auxiliarydate embedding operation.
 5. The method of claim 3 wherein the fixedvalues are averages of selected groups of elements in the data set, andthe variable values are difference values of elements in the selectedgroups.
 6. The method of claim 1 wherein the invertible transformcomprises an integer to integer invertible transform.
 7. A method ofreversibly embedding auxiliary data in a data set comprising: using acomputer programmed to perform acts of: transforming the data set froman original domain into transformed data values with an invertibletransform; expanding selected data values to embed auxiliary data;inverting the transformed data values, including the data valuesselected for expansion, to return the transformed data values to theoriginal domain; wherein expanding comprises multiplying a firstselected data value by a desired number of states and adding a numbercorresponding to a selected state of an auxiliary data value to beembedded in the first selected data value, and repeating the multiplyingand adding for other data values selected for expansion to embedadditional auxiliary data values.
 8. The method of claim 7 including:identifying data values that can be expanded to embed auxiliary datavalues without causing an underflow or overflow.
 9. The method of claim7 wherein the number of states is two, and the multiplying is performedby shifting bit positions in data values selected for expansion.
 10. Themethod of claim 1 wherein data values selected for embedding expansioncorrespond to embedding locations that have a property that is invariantto changes due to embedding of the auxiliary data, and wherein theinvariant property enables a decoder to identify embedding locations byanalysis of the property at the embedding locations.
 11. The method ofclaim 10 wherein the invariant property is identified based on whether adata value at an embedding location can be changed to embed data withoutcausing an underflow or overflow condition.
 12. A computer readablestorage medium on which is stored instructions for performing the methodof claim
 1. 13. A method of reversibly embedding auxiliary data in adata set comprising: using a computer programmed to perform acts of:transforming the data set from an original domain into transformed datavalues with an invertible transform; expanding selected data values toembed auxiliary data; inverting the transformed data values, includingthe data values selected for expansion, to return the transformed datavalues to the original domain; wherein the invertible transformcomprises a transform to average and difference values, the differencevalues forming a set from which values are selected for auxiliary dataembedding by expansion.
 14. The method of claim 1 wherein the data setcomprises an image signal.
 15. The method of claim 1 wherein thetransforming, expanding and inverting is performed repeatedly to dataelements at embedding locations within the data set to embed two or morelayers of auxiliary data.
 16. The method of claim 15 wherein each layerhas a different decoding key used to decode the layer.
 17. A method ofreversibly embedding auxiliary data in a data set comprising: using acomputer programmed to perform acts of: transforming the data set froman original domain into transformed data values with an invertibletransform; expanding selected data values to embed auxiliary data;inverting the transformed data values, including the data valuesselected for expansion, to return the transformed data values to theoriginal domain; wherein expanding includes inserting one or more extrabits into a selected data value to increase the number of bits after amost significant, non-zero bit, wherein the auxiliary data is carried inthe one or more extra bits.
 18. A method of reading auxiliary datareversibly embedded in a data set and restoring the data set to the samevalues as before the reversible embedding, the method comprising: usinga computer programmed to perform acts of: transforming the data set froman original domain into transformed data values with an invertibletransform; extracting auxiliary data from data values previouslyselected for embedding of auxiliary data by expansion, includingrestoring the selected data values to the same values as before theembedding of the auxiliary data; and inverting the transformed datavalues, including the data values selected for expansion, to return thetransformed data values to the original domain.
 19. A computer readablestorage medium on which is stored instructions for performing the methodof claim
 18. 20. The method of claim 18 wherein one or more bits of thedata values carry auxiliary data, and extracting includes reading theone or more bits of the data values.
 21. The method of claim 18including: identifying data values that have an invariant property toembedding of auxiliary data to determine which data values are carryingauxiliary embedded data.
 22. A method of reversibly embedding auxiliarydata in a data set comprising: using a computer programmed to performacts of: selecting embedding locations in the data set where data valueshave a property that is invariant to changes due to embedding of theauxiliary data, and wherein the invariant property enables a decoder toidentify embedding locations by analysis of the property of the datavalues; and reversibly embedding auxiliary data into data values at theembedding locations; including expanding selected data values to embedauxiliary data, wherein the expanding includes inserting one or moreextra bits into a data value to increase the number of bits after a mostsignificant, non-zero bit, wherein the auxiliary data is carried in theone or more extra bits.
 23. A method of reversibly embedding auxiliarydata in a data set comprising: using a computer programmed to performacts of: selecting embedding locations in the data set where data valueshave a property that is invariant to changes due to embedding of theauxiliary data, and wherein the invariant property enables a decoder toidentify embedding locations by analysis of the property of the datavalues; and reversibly embedding auxiliary data into data values at theembedding locations; including expanding selected data values to embedauxiliary data, wherein expanding includes multiplying a data value by anumber of states and adding a state corresponding to an auxiliary datavalue to be embedded.
 24. The method of claim 22 wherein the invariantproperty is identified based on whether a data value at an embeddinglocation can be changed without causing an underflow or overflow.
 25. Acomputer readable storage medium on which is stored instructions forperforming the method of claim
 22. 26. A method of decoding reversiblyembedded auxiliary data in a data set comprising: using a computerprogrammed to perform acts of: identifying a subset of locations in thedata set where data values have a property that is invariant to changesdue to embedding of the auxiliary data; extracting auxiliary data fromdata values at the identified locations; and restoring values of thedata set to the same values as before the embedding of the auxiliarydata into the data set; wherein the auxiliary data includes a locationmap indicating which of the subset of locations has been embedded withauxiliary data by expansion.
 27. A computer readable storage medium onwhich is stored instructions for performing the method of claim
 26. 28.The method of claim 26 wherein the auxiliary data is embedded byexpansion of data values.
 29. The method of claim 26 wherein theauxiliary data includes a location map indicating which of the subset oflocations has been embedded with auxiliary data by expansion.
 30. Amethod of embedding auxiliary data in a data set comprising: using acomputer programmed to perform acts of: identifying values derived fromthe data set that are expandable; and expanding the identified values byinserting an auxiliary data state corresponding to auxiliary data to beembedded in the identified values; wherein the identified values arederived by exploiting correlation within the data set to compute valuesthat are a function of the values in the original data set and that aremore expandable than the values in the original data set.